Re: Single Account Being locked out frequently

Actually the guy is really being locked out periodically here at the office.
He'll enter his username/password and it will be rejected. I'll try it at
another workstation and it will still get rejected. I changed the DNS to only
use the primary IP last night and that seemed to fix it for a while. After
I'd reconfigured for the new IP ranges and RRAS it was using the IP for the
RRAS tunnel termination for DNS too.

So you're thinking that maybe somewhere there is something trying to logon
with his account and that's what periodically locks him out with the locked
account? I thought I'd checked this the last time and his account wasn't
locked out.

Here's the other alert I'm getting - Event ID 539. Eventid.net hasnt' given
me much to work with yet.

Alert on LIGHTHOUSE at 2/21/2007 11:02:24 AM

An account was locked out due to multiple failed logon attempts that
occurred in a short period of time. This may occur if an unauthorized user
attempts to gain access to the network.




"Dave Nickason [SBS MVP]" wrote:

Last time I had this what fixed it is CP -> User Accounts -> Advanced ->
Manage Passwords. Delete all the saved passwords.

But I don't ever remember seeing that exact error message. Any help at
http://eventid.net/display.asp?eventid=12294&eventno=875&source=SAM&phase=1?

"Lin" <Lin@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:A8689C9E-413C-43A0-8246-E0A2F8BB3D2D@xxxxxxxxxxxxxxxx
We have a SBS 2003 Premium with about 40 users on it. After we moved to a
new
building everything went okay except that one user frequently can't logon
and
ends up logged out. Of course, it's my boss :-)

We tried resetting the password, no luck. This is the error I see in the
event log but I'm not sure how to interpret the error code at the end.
Anyone
ever run into this? P.S. I also checked this on several workstations and
it's
the same for that account everywhere.

Event Type: Error
Event Source: SAM
Event Category: None
Event ID: 12294
Date: 2/20/2007
Time: 11:43:53 PM
User: wb\wwest
Computer: LIGHTHOUSE
Description:
The SAM database was unable to lockout the account of wwest due to a
resource error, such as a hard disk write failure (the specific error code
is
in the error data) . Accounts are locked after a certain number of bad
passwords are provided so please consider resetting the password of the
account mentioned above.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: a5 02 00 c0 ¥..À




.

Relevant Pages

  • Re: Account lockouts
    ... for reusable passwords and the AAA infrastructures that rely upon them? ... In that context, account lockout policy -- duration, threshold, lockout ... > cracking attacks. ...
    (microsoft.public.security)
  • Re: ".forward" in mail logs
    ... > I haven't seen any distribution with such an account existing by default, ... service (but not sendmail) died. ... > If there's passwords for these users (logon, ...
    (comp.os.linux.security)
  • Re: Making xp login to desktop
    ... It's called "Automatic Logon". ... Microsoft Method 2: ... In the new Windows that appears select the account you wish to make the ... Have more than one administrator level account (with strong passwords). ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: My solution
    ... > find out what the cause was, but I could not logon to XP ... > with any combination of passwords. ... > Administrator account that way either. ... > told me that I would just have to reformat and lose all ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Deleting Admin Account
    ... administrative level account to change the Type of the Admin account ... created to a limited account (or create yourself a third account - non-admin ... The built-in administrator cannot be changed from the administrative level, ... You should password protect (with different passwords would be best) each ...
    (microsoft.public.windowsxp.setup_deployment)