Re: All AD User Accounts Locked
From: Patrick Ruane (PatrickRuane_at_discussions.microsoft.com)
Date: 12/03/04
- Next message: MittonE: "Password Policy"
- Previous message: Dean: "Deleting Multiple AD users"
- In reply to: Rob: "Re: All AD User Accounts Locked"
- Messages sorted by: [ date ] [ thread ]
Date: Fri, 3 Dec 2004 05:09:01 -0800
Thanks Rob. We identified the problem as being caused by the Gaobot virus
(updates didn't pick it up unfortunately). I've written a couple of scripts,
one to unlock all domain accounts if it happens again (not the most secure
thing in the world, but only temporary) and another one that runs at system
startup that deletes the virus, registry keys and modifies the hosts file,
oh, and emails me what it has done :) (as you can tell, i'm proud of that
one). If anyone wants any sample scripts, let me know.
"Rob" wrote:
> I just suffered the same exact scenario, twice, from our HQ in another
> country. The way to identify the problem quickly, is 1) review security
> logs on domain controllers (security logs will indicate the workstation name
> that is locking the account our. You will see many entries for your
> accounts, but likely on one workstation. 2) As in our case, DNS/WINS/DHCP
> did not have a listing for the workstation name. The accounts could only be
> locked out via our Domain controllers, so I ran the netstat command on each
> Domain Controller to see which one had a session with the suspected
> workstation. 3) Once I identified which domain controller was locking the
> accounts out, I ran NBTSTAT -c to review the remote name cache. There I
> found the name & ip address pair. 4) Now that I had a IP address, I routed
> all traffic from the offending host to NULL0 on our router or switch.
>
> Rob
>
>
> "Patrick Ruane" <Patrick Ruane@discussions.microsoft.com> wrote in message
> news:336F9C48-EEA3-429B-AE10-78976351D5F0@microsoft.com...
> > Hi Guys
> >
> > I have a problem with all my domain user accounts locking out at the same
> > time. It happens fairly randomly and we cannot identify any particular
> > event
> > that causes this. We have a 2000 domain in mixed mode with 95/98/2000/xp
> > clients. Has anyone come across this before, or knows of a reason why
> > this
> > is happening?
> >
> > Also, does anyone have a script for unlocking all user accounts?
> >
> > Thanks in advance for any help.
>
>
>
- Next message: MittonE: "Password Policy"
- Previous message: Dean: "Deleting Multiple AD users"
- In reply to: Rob: "Re: All AD User Accounts Locked"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
