Re: Problem

This looks like someone either is unable to logon or they recently changed
their password and their is a task, service on this machine or they are
logged onto another machine that the password hasn't been changed.

+++++++++++++

Is the account logged into more than one machine or is it running a service
on the same machine? A user could have mapped drives to a resource from one
machine, on a different machine he changes his password and then the first
machine attempts to stay mapped to a drive and the password is no longer
correct and eventually locks the user out. Or after a password is changed a
service is running that attempts to authenticate with an old password.

To help try and track down where the account is getting locked out use
eventcomboMT.exe from the Account Lockout tools found out Microsoft's
website. Use the built in search AccountLockouts and search in the created
text files for the user in question.

http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=7af2e69c-91f3-4e63-8629-b999adde0b9e


--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2003, 2000 (Early Achiever), NT

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

"chris" <chris@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:CD27C8DC-5072-4DDA-8348-4CFD1E44FAA0@xxxxxxxxxxxxxxxx
Hi,

Pls advise why is the user being logout. What is the possible reason?

Thanks



Problem 1

Event ID : 539
Type :Failure Aud
Source :Security
User : NT Authority\System


Logon Failure:
Reason: Account locked out
User Name: msl
Domain: RTTIBS
Logon Type: 2
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: TRFXP209




Problem 2
Event ID : 529
Type :Failure Aud
Source :Security
User : NT Authority\System


Logon Failure:
Reason: An error occurred during logon
User Name: itsecadmin
Domain: RTTIBS
Logon Type: 11
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: TRFXP209
Status code: 0xC000005E
Substatus code: 0x0


.

Relevant Pages

  • Re: Problem
    ... Is the account logged into more than one machine or is it running a service ... What is the possible reason? ... Logon Type: 2 ... Logon Process: User32 ...
    (microsoft.public.windows.server.active_directory)
  • Re: Account lockout
    ... Logon type 4 is for batch jobs. ... it fails as the account is locked. ...
    (microsoft.public.security)
  • Re: Problem
    ... It attaches to EventLogs ... with the account you log onto the XP machine. ... 539 - Account is locked out, logon failed ... Logon Type: 2 ...
    (microsoft.public.windows.server.active_directory)
  • [EC-SA-01.2003] Windows XP "welcome screen" exposes the names of all the members of the l
    ... logon screen with what is called "Welcome Screen". ... (including the original administrator account, ... Using the "welcome screen" actually disables / ignores the security ...
    (Bugtraq)
  • Re: ATTN : Microsoft - Security Event 529....Second Request for help....
    ... According to the events, the logon ... failure is from the local machine account. ... disconnected from the network. ... Security Event ID 529 is a failure audit for logon/logoff. ...
    (microsoft.public.windows.server.sbs)