Re: account locked out multiple times per day

Good idea - never thought of that.

IMO the first thing to do when you start getting lockouts is to go to CP ->
Users and delete the saved passwords.


"Henry Craven {SBS-MVP}" <sme@xxxxxxxxxxxxxx> wrote in message
news:46E57959-6BF0-47F7-A00D-996E65254B8D@xxxxxxxxxxxxxxxx
Run Procmon on the Workstation and see if you can pick up what's making
the NTLM Calls

--
Henry Craven {SBS-MVP}


"Joseph O'Brien" <obrien1984@xxxxxxxxxxx> wrote in message
news:1184853521.211882.207440@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
I'm having a bizarre problem with an account that gets locked out
multiple times per day.

My account was previously a member of the domain admins group for a
long time. Bad, I know. So, recently I pulled the account from domain
admins and made it a member of domain users.

However, it seems like if I'm not a member of domain admins, my
account gets locked out every hour or two. From the SBS 2003 security
logs:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 539
Date: 7/18/2007
Time: 3:50:42 PM
User: NT AUTHORITY\SYSTEM
Computer: BIGSERVER01
Description:
Logon Failure:
Reason: Account locked out
User Name: jobrien
Domain: SERVER01
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: 606
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.1.138
Source Port: 2193

Prior to this entry are multiple success audits from my account and
others, which seems normal.

I have checked my machine and others for scheduled processes that
might be running with my username, etc., but I don't see anything
unusual. The security policy is set to lock out accounts after 50
invalid login attempts. I assume that those invalid attempts should
show up in the security log, which they do not.

Can anyone give me advice on how to troubleshoot this?

Thanks.
Joseph




.

Relevant Pages
Loading