Questions

I have a user (XP pro) who gets locked out of her account every day.

+
0 Votes
Locked

I have a user (XP pro) who gets locked out of her account every day.

btoohey
Every evening after the user leaves I go into AD and unlock her account the next morning she is locked again. I've made a completely new profile on the pc and in AD and she is still getting locked out. I've unplugged the pc's power to rule out the Auto startup we have running and had no luck.
Any ideas are MUCH appreciated
  • +
    0 Votes
    jewuk_bali

    please help me how can i get example test of ccna 2 v2.1

    +
    0 Votes
    jdclyde

    you can't.

    +
    0 Votes
    Baltierra

    Hey Jewuk,

    The best place I have gotten my test examples for CCNA is: http://www.actual-exams.com/

    I had taken my CCNA 2 twice then found this site through a friend. Studied the material and passed. Hope the best..

    Thanks
    Baltierra

    +
    0 Votes
    CG IT

    and what are in the domain security logs? is there a lot of failed logon attempts?

    typically wrong user name or password lockout policy is anywhere from 10 to 30 minutes. complete lockout requires an admin to go into AD Users and Computers/her user account and manually lock the account.

    +
    0 Votes
    btoohey

    her account is being locked out before she ever attempts to login. The account is setup the same exact way as all other users and no other user has had the issue.

    +
    0 Votes
    btoohey

    her account is being locked out before she ever attempts to login. The account is setup the same exact way as all other users and no other user has had the issue.

    +
    0 Votes
    sgt_shultz

    a virus or a hacker fits your symptoms.

    +
    0 Votes
    btoohey

    The event logs are free of any "failed logon attempts" or any other warnings for that matter besides 1 printer issue 2 weeks ago. I doubt it is a hacker, besides the one user on the pc having login issues the pc is trouble free.

    +
    0 Votes
    sgt_shultz

    just to have you say you already tried it
    call microsoft

    +
    0 Votes
    neilb@uk

    Or can you track down when it started to something like a password change? This can cause this issue if the user has a scheduled task that's trying to run with her as the user or a drive mapping on another PC is trying to re-establish using the old password.

    Edited to add some helpers...
    http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=7af2e69c-91f3-4e63-8629-b999adde0b9e

    +
    0 Votes
    btoohey

    everything was fine for a few days but I discovered a typo in her acct and corrected it, the issue started shortly after. I then deleted the acct completely off the pc and AD and recreated it with the correct spelling. I'll have to check the scheduled tasks and the drive mappings but as far as aI know her mapped drives are all accessable.
    Thanks for the ideas so far and keep them coming.
    Brian

    +
    0 Votes
    btoohey

    I checked scheduled tasks and there where none and her mapped drives opened without issue.

    +
    0 Votes
    pc21geek

    Does the client have a saved password in XP?
    Go into the control panel, then users, click on her name, then on the Advanced tab to the right. Then click on Manage Passwords. If she has an old password stored in there (proxy, mapped drive, etc) then it will lock her out all the time.
    Not sure this is your issue, but its one more thing to look at.

    Good luck,

    Kevin

    +
    0 Votes
    pc21geek

    Does the client have a saved password in XP?
    Go into the control panel, then users, click on her name, then on the Advanced tab to the right. Then click on Manage Passwords. If she has an old password stored in there (proxy, mapped drive, etc) then it will lock her out all the time.
    Not sure this is your issue, but its one more thing to look at.

    Good luck,

    Kevin

    +
    0 Votes
    CompHelpNJ

    Perhaps this user is logged onto more than one workstation? It doesn't have to be a scheduled task that is causing the problem - simply being logged onto another workstation with an expired password could result in account lock outs.

    +
    0 Votes
    btoohey

    It turns out theat the user was at a different cube when she started and was still logged on. Now I just have to wait for tomorrow morning to verify that was the cause. I can't imagine what else it could be.
    Thanks!!!

    +
    0 Votes
    aletha

    I had something like this before, the user is logged in elsewhere on another PC. Most properly a PC that is not shutdown everyday and is still on all this time. Check the Event logged on the AD server, that is how I found out.

    +
    0 Votes
    KaryDavis

    I'm just curious because I had the same problem once, only I was the user logged in on a machine I was working and had changed my password before going back to it....

    +
    0 Votes
    Your Mom 2.0

    Dontcha hate it when someone submits a question, asks for help, takes your suggestion, and then doesn't follow up to tell you if it worked? Where's the learning opportunity in that?

    Brian, where ever you are, you're a tech-tease.

    +
    0 Votes
    jscogin

    Make sure there is noone on the network with teh same Computer name.

    Lete me know if you find a solution to your problem.


    Jeremy

    +
    0 Votes
    hpesulima

    Please check your License, check or you have enough.

    +
    0 Votes
    caricc135

    Try making sure your Active directory has the correct info then for an update across your servers. This new replication should fix the error.

    +
    0 Votes
    rippleintheforce

    This can happen when the user is logged into two different machines and changes the password on one but does not log out of the other. Make sure the user is not logged in to two different machines. Hope this helps.
    jd

    +
    0 Votes
    Will.Conner

    Another thing to look at is make sure that the account is not set to expire after one day on the AD setup. Just a thought.

    +
    0 Votes
    keq

    possible:
    Is there a service associated with the account. If so, and the user has changed her password since the service was setup you'll have to either change the password for the service to match the current password or associate the service with another account.

    +
    0 Votes
    a.southern

    Has she been annoying any of her collegues lately?

    One brilliant practical joke is to go to a non-descript terminal and put her logon name in and "alsdfhas" "asldfhafd" and "qlretjh" as her password three consecutive times.

    Most systems will then lock the account.

    Brilliant "joke" to play on your collegues, especially if the first time you do it, wait behind their desk and after it says "Account locked out" go up to them and tell them Bill Jones from Personnel/HR was here asking about them..........

    -AS

    +
    0 Votes
    jeff

    A much funnier and less destructive prank is to use the Win XP screen rotation feature on a user's PC when their back is turned. This is achieved using 'CTRL + ALT + (arrow key)', the arrow key you use (up, down, left, right) is the edge of the screen where the top edge of the image will be. Very perplexing if you don't know about this feature.

    You wouldn't believe the number of people who do this accidentally when trying to press 'CTRL + ALT + DEL' and then phone the helpdesk in a panic because their screen has turned upside down!!!

    +
    0 Votes
    a.southern

    I can't get this to work!

    Is this on XP pro still?

    -AS

    +
    0 Votes
    rcassel

    If the user has manually mounted a drive on another PC with his or her User ID and an old password the account will be locked out after a few hours.

    +
    0 Votes
    Jxoco

    We have the same thing with one of our users. A long time user, but we just instituted password changing after 30 days.
    So if she has a drive mapping 'out there' how can I find the machine that the mapping is on.
    Like a needle in a haystack we have about 700 machines on the network. How can I narrow it down?

    +
    0 Votes
    MrRich

    You ought to be able to check her logons on your DC's event log. Once you know which machines she has used its easy, just check those workstations for the drive mappings.
    RDP to the workstation and log in as the user.
    (Which may mean changing her password again...)

    Another way would be to set her a logon script that lists the mapped drives to a file. Run that for a few days and see what you get.

    +
    0 Votes
    lyle

    Many users type the password incorrectly or do not remember it. How many tries does she get before being locked out? Is she in the habit of always having the Caps Lock on? Also with many systems requiring several passwords - Domain, AS/400, Firewall, etc. it is easy to confuse even appearantly savvy users as to which password is used when.

    +
    0 Votes
    bmacias

    Has the user logged into another computer or server (terminal Server) since last password change? I don't suppose you have any logging or alert system turned on that would tell you which machine is making the calls (You using sitescope)? The Lockout could be caused by a service or schedule task running with user's old credentials (I hold company lock out record for that one).

    +
    0 Votes
    308Tom

    A user who "forgot" they had logged on to another computer, failed to logoff AND had changed their password in the interim has been my most common cause of this issue. Usually they only "remember" after you find the offending workstation.

    Check the Domain Controller security logs to find what may be a 529 error or a Kerberos error 0x18 and may have the user's ID in it. That will yield the IP address of the station that is trying to authenticate with a bad password and triggering the lockout.

    Another possibility is the user mapped a persistent static drive with their credential while another user was logged in on another machine - and subsequently changed their password.

    Again back to the Domain Controller security logs to find the offending IP.

    +
    0 Votes
    bconley

    Perhaps at some point she saved a password that authenticates her to some domain resource such as authenticating to a file share or IIS site. We have a analytical cell counter instrument that uses IIS.

    +
    0 Votes
    cawallace007

    This has only happened after a password change for my users, including myself.

    It gets fixed by doing the following, not sure which one.

    Turn off cache mode in MS Outlook.
    Delete and recreate any printers or drive mappings that were created locally versus through domain login.

  • +
    0 Votes
    jewuk_bali

    please help me how can i get example test of ccna 2 v2.1

    +
    0 Votes
    jdclyde

    you can't.

    +
    0 Votes
    Baltierra

    Hey Jewuk,

    The best place I have gotten my test examples for CCNA is: http://www.actual-exams.com/

    I had taken my CCNA 2 twice then found this site through a friend. Studied the material and passed. Hope the best..

    Thanks
    Baltierra

    +
    0 Votes
    CG IT

    and what are in the domain security logs? is there a lot of failed logon attempts?

    typically wrong user name or password lockout policy is anywhere from 10 to 30 minutes. complete lockout requires an admin to go into AD Users and Computers/her user account and manually lock the account.

    +
    0 Votes
    btoohey

    her account is being locked out before she ever attempts to login. The account is setup the same exact way as all other users and no other user has had the issue.

    +
    0 Votes
    btoohey

    her account is being locked out before she ever attempts to login. The account is setup the same exact way as all other users and no other user has had the issue.

    +
    0 Votes
    sgt_shultz

    a virus or a hacker fits your symptoms.

    +
    0 Votes
    btoohey

    The event logs are free of any "failed logon attempts" or any other warnings for that matter besides 1 printer issue 2 weeks ago. I doubt it is a hacker, besides the one user on the pc having login issues the pc is trouble free.

    +
    0 Votes
    sgt_shultz

    just to have you say you already tried it
    call microsoft

    +
    0 Votes
    neilb@uk

    Or can you track down when it started to something like a password change? This can cause this issue if the user has a scheduled task that's trying to run with her as the user or a drive mapping on another PC is trying to re-establish using the old password.

    Edited to add some helpers...
    http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=7af2e69c-91f3-4e63-8629-b999adde0b9e

    +
    0 Votes
    btoohey

    everything was fine for a few days but I discovered a typo in her acct and corrected it, the issue started shortly after. I then deleted the acct completely off the pc and AD and recreated it with the correct spelling. I'll have to check the scheduled tasks and the drive mappings but as far as aI know her mapped drives are all accessable.
    Thanks for the ideas so far and keep them coming.
    Brian

    +
    0 Votes
    btoohey

    I checked scheduled tasks and there where none and her mapped drives opened without issue.

    +
    0 Votes
    pc21geek

    Does the client have a saved password in XP?
    Go into the control panel, then users, click on her name, then on the Advanced tab to the right. Then click on Manage Passwords. If she has an old password stored in there (proxy, mapped drive, etc) then it will lock her out all the time.
    Not sure this is your issue, but its one more thing to look at.

    Good luck,

    Kevin

    +
    0 Votes
    pc21geek

    Does the client have a saved password in XP?
    Go into the control panel, then users, click on her name, then on the Advanced tab to the right. Then click on Manage Passwords. If she has an old password stored in there (proxy, mapped drive, etc) then it will lock her out all the time.
    Not sure this is your issue, but its one more thing to look at.

    Good luck,

    Kevin

    +
    0 Votes
    CompHelpNJ

    Perhaps this user is logged onto more than one workstation? It doesn't have to be a scheduled task that is causing the problem - simply being logged onto another workstation with an expired password could result in account lock outs.

    +
    0 Votes
    btoohey

    It turns out theat the user was at a different cube when she started and was still logged on. Now I just have to wait for tomorrow morning to verify that was the cause. I can't imagine what else it could be.
    Thanks!!!

    +
    0 Votes
    aletha

    I had something like this before, the user is logged in elsewhere on another PC. Most properly a PC that is not shutdown everyday and is still on all this time. Check the Event logged on the AD server, that is how I found out.

    +
    0 Votes
    KaryDavis

    I'm just curious because I had the same problem once, only I was the user logged in on a machine I was working and had changed my password before going back to it....

    +
    0 Votes
    Your Mom 2.0

    Dontcha hate it when someone submits a question, asks for help, takes your suggestion, and then doesn't follow up to tell you if it worked? Where's the learning opportunity in that?

    Brian, where ever you are, you're a tech-tease.

    +
    0 Votes
    jscogin

    Make sure there is noone on the network with teh same Computer name.

    Lete me know if you find a solution to your problem.


    Jeremy

    +
    0 Votes
    hpesulima

    Please check your License, check or you have enough.

    +
    0 Votes
    caricc135

    Try making sure your Active directory has the correct info then for an update across your servers. This new replication should fix the error.

    +
    0 Votes
    rippleintheforce

    This can happen when the user is logged into two different machines and changes the password on one but does not log out of the other. Make sure the user is not logged in to two different machines. Hope this helps.
    jd

    +
    0 Votes
    Will.Conner

    Another thing to look at is make sure that the account is not set to expire after one day on the AD setup. Just a thought.

    +
    0 Votes
    keq

    possible:
    Is there a service associated with the account. If so, and the user has changed her password since the service was setup you'll have to either change the password for the service to match the current password or associate the service with another account.

    +
    0 Votes
    a.southern

    Has she been annoying any of her collegues lately?

    One brilliant practical joke is to go to a non-descript terminal and put her logon name in and "alsdfhas" "asldfhafd" and "qlretjh" as her password three consecutive times.

    Most systems will then lock the account.

    Brilliant "joke" to play on your collegues, especially if the first time you do it, wait behind their desk and after it says "Account locked out" go up to them and tell them Bill Jones from Personnel/HR was here asking about them..........

    -AS

    +
    0 Votes
    jeff

    A much funnier and less destructive prank is to use the Win XP screen rotation feature on a user's PC when their back is turned. This is achieved using 'CTRL + ALT + (arrow key)', the arrow key you use (up, down, left, right) is the edge of the screen where the top edge of the image will be. Very perplexing if you don't know about this feature.

    You wouldn't believe the number of people who do this accidentally when trying to press 'CTRL + ALT + DEL' and then phone the helpdesk in a panic because their screen has turned upside down!!!

    +
    0 Votes
    a.southern

    I can't get this to work!

    Is this on XP pro still?

    -AS

    +
    0 Votes
    rcassel

    If the user has manually mounted a drive on another PC with his or her User ID and an old password the account will be locked out after a few hours.

    +
    0 Votes
    Jxoco

    We have the same thing with one of our users. A long time user, but we just instituted password changing after 30 days.
    So if she has a drive mapping 'out there' how can I find the machine that the mapping is on.
    Like a needle in a haystack we have about 700 machines on the network. How can I narrow it down?

    +
    0 Votes
    MrRich

    You ought to be able to check her logons on your DC's event log. Once you know which machines she has used its easy, just check those workstations for the drive mappings.
    RDP to the workstation and log in as the user.
    (Which may mean changing her password again...)

    Another way would be to set her a logon script that lists the mapped drives to a file. Run that for a few days and see what you get.

    +
    0 Votes
    lyle

    Many users type the password incorrectly or do not remember it. How many tries does she get before being locked out? Is she in the habit of always having the Caps Lock on? Also with many systems requiring several passwords - Domain, AS/400, Firewall, etc. it is easy to confuse even appearantly savvy users as to which password is used when.

    +
    0 Votes
    bmacias

    Has the user logged into another computer or server (terminal Server) since last password change? I don't suppose you have any logging or alert system turned on that would tell you which machine is making the calls (You using sitescope)? The Lockout could be caused by a service or schedule task running with user's old credentials (I hold company lock out record for that one).

    +
    0 Votes
    308Tom

    A user who "forgot" they had logged on to another computer, failed to logoff AND had changed their password in the interim has been my most common cause of this issue. Usually they only "remember" after you find the offending workstation.

    Check the Domain Controller security logs to find what may be a 529 error or a Kerberos error 0x18 and may have the user's ID in it. That will yield the IP address of the station that is trying to authenticate with a bad password and triggering the lockout.

    Another possibility is the user mapped a persistent static drive with their credential while another user was logged in on another machine - and subsequently changed their password.

    Again back to the Domain Controller security logs to find the offending IP.

    +
    0 Votes
    bconley

    Perhaps at some point she saved a password that authenticates her to some domain resource such as authenticating to a file share or IIS site. We have a analytical cell counter instrument that uses IIS.

    +
    0 Votes
    cawallace007

    This has only happened after a password change for my users, including myself.

    It gets fixed by doing the following, not sure which one.

    Turn off cache mode in MS Outlook.
    Delete and recreate any printers or drive mappings that were created locally versus through domain login.