Re: Account lockout every hour

Are you logged into more than one machine? Usually what happens is a user
has mapped drives to a resource from one machine, on a different machine he
changes his password and then the first machine attempts to stay mapped to a
drive and the password is no longer correct and eventually locks the user
out.

To help try and track down where the account is getting locked out use
eventcomboMT.exe from the Account Lockout tools found out Microsoft's
website. Use the built in search AccountLockouts and search in the created
text files for the user in question.

http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=7af2e69c-91f3-4e63-8629-b999adde0b9e



--
Paul Bergson MCT, MCSE, MCSA, Security+, CNE, CNA, CCA
http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup

This posting is provided "AS IS" with no warranties, and confers no rights.

"Anastasios Papadopoulos" <tpapad@xxxxxxxxxxxxxxxxxxx> wrote in message
news:ljgri3-nbu.ln1@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hi everyone,

I have a problem in our Win2003 AD environment.
After I changed my password (I'm member of Domain Admins) I get an
"Account Lockout (Event ID: 539)" every 1 hour. I tried to trace the cause
and all I found was a 552 event some moments before 539. The 552 event is
"Logon attempt using explicit credentials", where the PDC$ account tries
to use my DOM\user credentials. Note: this is a "Success Audit" event. The
caller process id of 552 maps to tcpsrvs.exe process (don't know why this
services tries to use my creds...).
I double checked all services and scheduled tasks, none using my account.
All I found about this problem as a solution was a workaround: change
password back to the old one during the time the event fires.
Needless to say, it didn't work...

Any suggestions?

It is very annoying to get locked out every hour and wait for some minutes
to get unlocked...


.

Relevant Pages

  • Re: disk mapping on web site
    ... Not sure what you means by "map the disk with the username". ... a particular account which is AFAIK error prone and in some cases difficult ... Keep in mind that mapped drives are tied to the account so you would need ... I need to move file from the server where there is my "web site" to ...
    (microsoft.public.dotnet.languages.vb)
  • Re: User Account Locked Out!!
    ... MVP - Directory Services ... A user could have mapped drives to a ... To help try and track down where the account is getting ... out use eventcombMT.exe from the Account Lockout tools found out ...
    (microsoft.public.windows.server.active_directory)
  • Re: stream problems
    ... I use an ofstream to do this. ... Don't use mapped drives to access a file from a service. ... Even if a service runs under your account, it might not have the same drive mapping as you have. ... And make sure that your service only starts after all network services have been startet. ...
    (microsoft.public.vc.mfc)
  • Re: Recurring account lockouts
    ... A user could have mapped drives to a resource from one ... To help try and track down where the account is getting locked out use ... eventcomboMT.exe from the Account Lockout tools found out Microsoft's ... Use the built in search AccountLockouts and search in the created ...
    (microsoft.public.windows.server.active_directory)
  • Re: Asp.Net, Web Service needing binaries off of a Mapped Drive
    ... ASP.NET user runs as a specialised account setting. ... this is an interesting read from another MVP Rick Strahl ... remote DLL's like the way you are trying to, but impersonation is likely to ... to these mapped drives in the path environment variable. ...
    (microsoft.public.dotnet.framework.aspnet)
Loading