WIndows NT 4.0 userID lock-out

Using User Manager, select Policies/Audit and turn on logging for Logon/Logoff successes and failures. Then use the Security log to find out if there is an obvious answer.

I have a couple of suggestions based on things I've seen that create this symptom.

First, check the Security Log on the PDC using Event Viewer and look for Failure audits of this userid attempting to logon/logoff. The time and source of these events will tell you a lot.

Someone might be mounting a denial of service attack, which is easy to do when you have automatic lockout engaged. The Security Log will tell you enough to decide if this is the case.

Is there any chance that the user might be logged onto his machine using one domain account and then opening an Exchange mailbox which belongs to another account (such as his account in a trusted domain)? Opening Exchange account X while logged into account Y, and then going idle(power management or screen saver), can sometimes cause account X to be locked out. I had a domain Y which trusted domain X and this happened every time until I told my people not to read their X e-mail from their Y accounts.

Two possibile causes:

1) This user is logged in at another workstation or (unattended) server with the old userid/password. Even if the machine is locked, background processes may use the old credentials and cause the lockout.
This problem can also be caused by a Terminal Server session, even a disconnected one.

2) The old userid/password were used as credentials for an NT service (Control Panel;Services;Start Up;Log on As).

Both cases can be difficult to troubleshoot, especially on larger networks.

Here's one possibility: The user logged on to a PC somewhere and his user name still comes up in the logon username field. Another user comes along, doesn't pay any attention to which username is in the field, tries to log on with his own password -tries it until the original users account is locked out. We saw this a lot on PCs with muliple users until we automatically blanked out the Username field.

Of course, you could have someone trying to get into the system with this users account.
Good luck.

The password probably expires. This is a setting in NT (on the server if they are logging into a network or on the local machine if it is a local password. You can change this by going into User manager, pull down the policies menu and select account. here you can set the password expiration time or lack there of.

Enable auditing on the PC for logon failures, and search that PC for event IDs 529 and 539. With NT, the logon failure is logged on the local machine. This will enable you to rule out this machine. If you find these event IDs here, check the services to see if they are authenticating using the user's old credentials.

If your primary domain controller is running service pack 4 or above (I think), you may also see event ID 644 on the PDC, but probably not the 529/539s, in which case, the 644 may point to a machine (it seems to be hit and miss, unfortunately) which has the user's logon credentials set up incorrectly. Search the machine for mapped drives, services and background processes that may be authenticating incorrectly.

This question was auto closed due to inactivity