Re: Problem
- From: chris <chris@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Sun, 20 May 2007 22:30:01 -0700
Hi,
User use Outlook Web Access to access email. All the while, the machine
is working fine. The AD is migrated to a new hardware and the user logout
issue THEN occur.
After clear the cache of the user workstation, it resolve the account
logout issue.
How does this happen. More and more people account are being logout.
"Paul Bergson [MVP-DS]" wrote:
Yes it should be able to be run on an XP machine. It attaches to EventLogs.
and filters them out. So you will need to be able to read a dc's eventlog
with the account you log onto the XP machine. It isn't used for monitoring
only for reading historically.
529 - Bad user id or password
539 - Account is locked out, logon failed
--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2003, 2000 (Early Achiever), NT
http://www.pbbergs.com
Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.
"chris" <chris@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:F31E9ED4-E2EB-4D62-8E22-A5D11539D152@xxxxxxxxxxxxxxxx
Hi Paul,
Can eventcomboMT.exe be installed on User XP Machine for monitoring?
What does the Event ID 539 and 529 means?
User is sharing machine for what I can tell you.
"Paul Bergson [MVP-DS]" wrote:
This looks like someone either is unable to logon or they recently
changed
their password and their is a task, service on this machine or they are
logged onto another machine that the password hasn't been changed.
+++++++++++++
Is the account logged into more than one machine or is it running a
service
on the same machine? A user could have mapped drives to a resource from
one
machine, on a different machine he changes his password and then the
first
machine attempts to stay mapped to a drive and the password is no longer
correct and eventually locks the user out. Or after a password is
changed a
service is running that attempts to authenticate with an old password.
To help try and track down where the account is getting locked out use
eventcomboMT.exe from the Account Lockout tools found out Microsoft's
website. Use the built in search AccountLockouts and search in the
created
text files for the user in question.
http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=7af2e69c-91f3-4e63-8629-b999adde0b9e
--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2003, 2000 (Early Achiever), NT
http://www.pbbergs.com
Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no
rights.
"chris" <chris@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:CD27C8DC-5072-4DDA-8348-4CFD1E44FAA0@xxxxxxxxxxxxxxxx
Hi,
Pls advise why is the user being logout. What is the possible reason?
Thanks
Problem 1
Event ID : 539
Type :Failure Aud
Source :Security
User : NT Authority\System
Logon Failure:
Reason: Account locked out
User Name: msl
Domain: RTTIBS
Logon Type: 2
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: TRFXP209
Problem 2
Event ID : 529
Type :Failure Aud
Source :Security
User : NT Authority\System
Logon Failure:
Reason: An error occurred during logon
User Name: itsecadmin
Domain: RTTIBS
Logon Type: 11
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: TRFXP209
Status code: 0xC000005E
Substatus code: 0x0
- Follow-Ups:
- Re: Problem
- From: Paul Bergson [MVP-DS]
- Re: Problem
- References:
- Re: Problem
- From: Paul Bergson [MVP-DS]
- Re: Problem
- From: chris
- Re: Problem
- From: Paul Bergson [MVP-DS]
- Re: Problem
- Prev by Date: Applying Group Policy based on Architecture
- Next by Date: Re: Kerberos erros on DC
- Previous by thread: Re: Problem
- Next by thread: Re: Problem
- Index(es):
Relevant Pages
|
