Re: Event ID: 538 Seems to lock out users

Enable auditing of "account logon events" on domain controllers - this will
bring information on the clients IP/name that the unsuccessfull
authentication come from. Then you will know the source where the wrong
attempts are done.

Then, on the client side, enable auditing of "logon events" and you will get
the process ID that tries to log on/impersonate the user.


O.



"Mick" <MickBurkellc@xxxxxxxxx> wrote in message
news:1137637553.551353.300280@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> I've been trying to fugue out a problem where users get locked out of
> the system and we have to reboot the system to get back in. Today it
> happened twice in about a 45 minute period, and i noticed Event ID: 538
> at each point of lock. It reported that there was an error with the
> administrators log-on and that it was a bad password. No one was
> logging on to the server at that point, so I'm wondering what else
> might be trying to access the system as administrator. I checked
> services and scheduled jobs, but didn't find anything.
>
> Can anyone suggest what else to check for the solution? Thanks!
>
> Mick
>


.

Relevant Pages

  • Re: how can i find out who have login to the computer bofore?
    ... Double click on Local Security Policy. ... right click on "Audit logon events". ... In order to enable auditing in XP Pro, ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: A way to log when a workstation Locks?
    ... If you enable auditing of logon events, ... logoffs in the security event log, but sadly, not for locking the ... Auditing of logon events has to be enabled on the computer via Local ... -- torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Who is Logged On?
    ... enable auditing of account logon events in Domain Controllers Security ... > I am new to Windows and have been on Netware too long, ... > is an intruder, but I cannot tell who is logged on now. ...
    (microsoft.public.win2000.security)
  • Re: Logging Logons and unlocks
    ... You would have to enable auditing of logon events on their workstations in the ... You can enable auditing of account logons in the Domain ... Controller Security Policy but it will only show when a user logged onto the domain ...
    (microsoft.public.win2000.security)
  • Re: Record of logins/logouts?
    ... If you enable auditing of logon events, ... logons and logoffs in the security event log. ... Auditing of logon events has to be enabled on the computer via Local ... -- torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: ...
    (microsoft.public.windowsxp.general)
Loading