Re: Problem


Hi Paul,

Can eventcomboMT.exe be installed on User XP Machine for monitoring?

What does the Event ID 539 and 529 means?

User is sharing machine for what I can tell you.



"Paul Bergson [MVP-DS]" wrote:

This looks like someone either is unable to logon or they recently changed
their password and their is a task, service on this machine or they are
logged onto another machine that the password hasn't been changed.

+++++++++++++

Is the account logged into more than one machine or is it running a service
on the same machine? A user could have mapped drives to a resource from one
machine, on a different machine he changes his password and then the first
machine attempts to stay mapped to a drive and the password is no longer
correct and eventually locks the user out. Or after a password is changed a
service is running that attempts to authenticate with an old password.

To help try and track down where the account is getting locked out use
eventcomboMT.exe from the Account Lockout tools found out Microsoft's
website. Use the built in search AccountLockouts and search in the created
text files for the user in question.

http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=7af2e69c-91f3-4e63-8629-b999adde0b9e


--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2003, 2000 (Early Achiever), NT

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

"chris" <chris@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:CD27C8DC-5072-4DDA-8348-4CFD1E44FAA0@xxxxxxxxxxxxxxxx
Hi,

Pls advise why is the user being logout. What is the possible reason?

Thanks



Problem 1

Event ID : 539
Type :Failure Aud
Source :Security
User : NT Authority\System


Logon Failure:
Reason: Account locked out
User Name: msl
Domain: RTTIBS
Logon Type: 2
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: TRFXP209




Problem 2
Event ID : 529
Type :Failure Aud
Source :Security
User : NT Authority\System


Logon Failure:
Reason: An error occurred during logon
User Name: itsecadmin
Domain: RTTIBS
Logon Type: 11
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: TRFXP209
Status code: 0xC000005E
Substatus code: 0x0



.

Relevant Pages

  • Re: Account lockout
    ... Logon type 4 is for batch jobs. ... it fails as the account is locked. ...
    (microsoft.public.security)
  • Re: Problem
    ... It attaches to EventLogs ... with the account you log onto the XP machine. ... 539 - Account is locked out, logon failed ... Logon Type: 2 ...
    (microsoft.public.windows.server.active_directory)
  • Re: Problem
    ... The AD is migrated to a new hardware and the user logout ... More and more people account are being logout. ... 539 - Account is locked out, logon failed ... Logon Type: 2 ...
    (microsoft.public.windows.server.active_directory)
  • Re: Problem
    ... This looks like someone either is unable to logon or they recently changed ... Is the account logged into more than one machine or is it running a service ... What is the possible reason? ... Logon Type: 2 ...
    (microsoft.public.windows.server.active_directory)
  • Re: Task scheduler problem
    ... the requested logon type at this computer." ... Security Settings / Local Policy / User Rights / Logon as a batch job. ... The attempt to log on to the account associated with the task failed, ... i have a problem with task scheduler. ...
    (microsoft.public.win2000.general)