Re: Users get locked out

Hi,

Thanks for updating.

I researched the MPS Report you gave me, please do the following:

The user account has been automatically locked because too many invalid
logon attempts or password change attempts have been requested.

This kind of issue may occur if:

1. User input wrong password for several times and because it exceeds the
threshold, the account is locked out.
2. There are third party applications using old password and keep trying to
logon with this invalid credential.
3. There are hacker application trying to logon to your system with these
accounts.

Now, please do the following on the client computer where the user account
logs from and let's see if this issue is caused by the third party
applications:

1. Click Start -> Run, type MSCONFIG and click OK.
2. Go to Services tab click the option to hide all Microsoft services and
then click the disable all button.
3. Go to Startup tab and click the Disable All button.
4. Restart the client computer and after the client logs on, let's wait to
see how this issue goes.

Also, please use an anti-virus with updated signatures and scan you machine.

For more information, please refer to:
Windows Defender Home
http://www.microsoft.com/athome/security/spyware/software/default.mspx

If the issue still exists, please do the following:

1. Make this problematic user logon to a good workstation, will the same
problem reoccur?

2. Enable Audit Logging

a. Open Default Domain policy, go to computer configuration\Windows
Settings\Security Settings\Local Policies\Audit Policy.
b. Enable to audit the following:
Audit Account Logon events
Audit Account Management
Audit Logon events
Set the audit option to audit both success and failure.

Then on SBS server and the client computer, go to command prompt, type
GPUPDATE /FORCE to refreshpolicy, then restart the client computers.

As the problem reoccurs, Audit event will be written in Event Viewer,
please copy the message and send to me.

3. Please give me the screen shot of the error message when the problem
occurs?

Please send the information to v-robeli@xxxxxxxxxxxx with subject:
38771543-Users get locked out.

I am looking forward to hear from you.

If you need further assistance, please don't hesitate to let me know.

Best regards,

Robert Li(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================

This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.

=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
<X-Tomcat-ID: 179280045
<References: <1176674076.509899.7140@xxxxxxxxxxxxxxxxxxxxxxxxxxx>
<1176928496.891100.11480@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>
<MIME-Version: 1.0
<Content-Type: text/plain
<Content-Transfer-Encoding: 7bit
<From: v-robeli@xxxxxxxxxxxxxxxxxxxx (Robert Li [MSFT])
<Organization: Microsoft
<Date: Thu, 19 Apr 2007 10:30:59 GMT
<Subject: Re: Users get locked out
<X-Tomcat-NG: microsoft.public.windows.server.sbs
<Message-ID: <pEWYY3mgHHA.3744@xxxxxxxxxxxxxxxxxxxxxx>
<Newsgroups: microsoft.public.windows.server.sbs
<Lines: 129
<Path: TK2MSFTNGHUB02.phx.gbl
<Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:31314
<NNTP-Posting-Host: TOMCATIMPORT1 10.201.218.122
<
<Hi,
<
<Thanks for updating and also for Lawench's input.
<
<I researched Event ID 8063, which seems not to be related to user lock out.
<
<Please let me know the following information:
<
<1. Can you ping the server when the problem occurs?
<
<Please kindly collect the information for further research:
<
<MPS Report
<
<1) Download MPS report tool from:
<http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd
9
<15706/MPSRPT_SETUPPerf.EXE
<2) Run the MPSRPT_SETUPPerf.exe on the server box.
<3) Wait for 10~15 minutes.
<4) Open Windows explorer, navigate to
<%SYSTEMROOT%\MPSReports\Setup\Reports\cab\
<5) Send the .cab file to us.
<
<2. Please give me the screen shot of the error message when the problem
<occurs?
<
<I am looking forward to hear from you.
<
<If you need further assistance, please don't hesitate to let me know.
<
<Best regards,
<
<Robert Li(MSFT)
<
<Microsoft CSS Online Newsgroup Support
<
<Get Secure! - www.microsoft.com/security
<
<=====================================================
<
<This newsgroup only focuses on SBS technical issues. If you have issues
<regarding other Microsoft products, you'd better post in the corresponding
<newsgroups so that they can be resolved in an efficient and timely manner.
<You can locate the newsgroup here:
<http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
<
<When opening a new thread via the web interface, we recommend you check
the
<"Notify me of replies" box to receive e-mail notifications when there are
<any updates in your thread. When responding to posts via your newsreader,
<please "Reply to Group" so that others may learn and benefit from your
<issue.
<
<Microsoft engineers can only focus on one issue per thread. Although we
<provide other information for your reference, we recommend you post
<different incidents in different threads to keep the thread clean. In
doing
<so, it will ensure your issues are resolved in a timely manner.
<
<For urgent issues, you may want to contact Microsoft CSS directly. Please
<check http://support.microsoft.com for regional support phone numbers.
<
<Any input or comments in this thread are highly appreciated.
<
<=====================================================
<
<This posting is provided "AS IS" with no warranties, and confers no rights.
<
<--------------------
<<From: frsd2@xxxxxxx
<<Newsgroups: microsoft.public.windows.server.sbs
<<Subject: Re: Users get locked out
<<Date: 18 Apr 2007 13:34:56 -0700
<<Organization: http://groups.google.com
<<Lines: 36
<<Message-ID: <1176928496.891100.11480@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>
<<References: <1176674076.509899.7140@xxxxxxxxxxxxxxxxxxxxxxxxxxx>
<< <eyO3cf7fHHA.588@xxxxxxxxxxxxxxxxxxxx>
<<NNTP-Posting-Host: 66.177.253.115
<<Mime-Version: 1.0
<<Content-Type: text/plain; charset="iso-8859-1"
<<X-Trace: posting.google.com 1176928497 24657 127.0.0.1 (18 Apr 2007
<20:34:57 GMT)
<<X-Complaints-To: groups-abuse@xxxxxxxxxx
<<NNTP-Posting-Date: Wed, 18 Apr 2007 20:34:57 +0000 (UTC)
<<In-Reply-To: <eyO3cf7fHHA.588@xxxxxxxxxxxxxxxxxxxx>
<<User-Agent: G2/1.0
<<X-HTTP-UserAgent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;
<.NET CLR 1.1.4322),gzip(gfe),gzip(gfe)
<<Complaints-To: groups-abuse@xxxxxxxxxx
<<Injection-Info: n76g2000hsh.googlegroups.com; posting-host=66.177.253.115;
<< posting-account=jmievA0AAAD3crDdZSyfBtykt1Is4Nw6
<<Path:
<TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTFEEDS02.phx.gbl!msrtrans
!
<msrn-in!newshub.sdsu.edu!postnews.google.com!n76g2000hsh.googlegroups.com!n
o
<t-for-mail
<<Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:31190
<<X-Tomcat-NG: microsoft.public.windows.server.sbs
<<
<<On Apr 15, 7:43 pm, "Lanwench [MVP - Exchange]"
<<<lanwe...@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
<<> f...@xxxxxxx wrote:
<<> > I have a situation where users get locked out of the shared drive
<<> > after 6:00 pm. The cannot save to the share nor to a diskette or
<<> > flash. During the regular work day all is well but if someone works
<<> > later the server locks them out. I've checked the quotas on the share
<<> > and the login times for all users and everything seems to check out
<<> > alright. The users can't give me the exact error message they get
<<> > because they get frustrated and close down their machine and I'm not
<<> > there to check it out. Any ideas?
<<>
<<> > Thanks
<<>
<<> Event logs on server & workstations?
<<> If you can't see anything there, they will really need to give you the
<exact
<<> error message if they want help.
<<
<<Checked the event log: this is what I found
<<MSExchangeAL
<<error code 8063
<<Could not read the root entry on directory 'EDC-SERVER2.edc.local'.
<<Cannot access configuration information. DC=edc,DC=local
<<
<<I clicked the link and got this answer:
<<
<<User Action
<<Verify network connectivity. Attempt to read attributes on the
<<directory. Make sure the ADC (Active Directory Connector) service
<<account has permissions to read its configuration information from the
<<Active Directory
<<
<<I've looked all over the server and cannot find ADC service.
<<
<<Thanks
<<
<<
<
<

.