User can't log on (weird)

Got a weird logon issue: W2K3 domain with DC running W2K3SP1, users are
XPSP2. One user keeps experiencing the following--he locks his workstation
and then can't unlock it. Security log has event 657 source Security failure
code 0x18 which indicates logon failed due to wrong username or password.
But user has correct username in logon box and is typing password correctly.
If I access the DC and reset the user's password to the same password he is
currently using, he can then unlock his workstation and access his open
desktop...anyone seen anything like this before and have an idea what might
be happening? Just started a few days ago, and nothing has changed on the
DC...

--
Cheers,
Mitch Tulloch
[MVP--Windows Server]
http://itreader.net




.

Relevant Pages

  • Re: bad logon attempts against the Unlock dialog box dont count
    ... Are you trying to unlock the machine with a different user than who has ... Can you please send precise steps to reproduce the problem? ... > a server or workstation using Ctrl+Alt+Delete, bad logon attempts against ...
    (microsoft.public.win2000.security)
  • Re: windows 2000 lock workstation auditing
    ... No events are logged when a workstation is locked. ... You see a logon and logoff event at unlock, ... then destroy the resultant, unneeded logon session. ...
    (microsoft.public.win2000.security)
  • Re: Email on user login/unlock
    ... I want to have a script fire off an email when a user logs in to one ... or when they unlock their session. ... Your best bet to detect when someone logs in is to use a domain-wide logon ... or program would be able to detect when the user unlocked the workstation. ...
    (microsoft.public.windows.server.scripting)
  • Re: Daily Server Report (Critical Errors, Event ID: 537)
    ... Also, Logon type of 3 is a network logon, this is considered a ... Does this issue happen on client workstation or server? ... Does your server and all clients' workstation work well now? ... issue in your Network? ...
    (microsoft.public.windows.server.sbs)
  • Re: Daily Server Report (Critical Errors, Event ID: 537)
    ... Also, Logon type of 3 is a network logon, this is considered a ... Does this issue happen on client workstation or server? ... Does your server and all clients' workstation work well now? ... issue in your Network? ...
    (microsoft.public.windows.server.sbs)