Windows Forum

Ask something
Discussion Locked

Windows 2000 Server Lockout

0 helpful
3 replies

by sharonb033

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
We had an interesting issue this morning. No one could log on to the network including the Administrator. When you tried it said it was locked and could only be opened by the Administrator. I'm an administrator so I even tried using my logon (didn'twork). What was even stranger is since I locked my machine last night instead of logging off, I had access but could not terminal service into the server. It eventually let us in but I don't know how. Anyone have any suggestions.

3 replies

by ewgny

Check you're event logs to see if your NIC card on the server dropped it's connection at some point. If a scheduled task was run under the context of your account and either the NIC connection dropped or you changed passwords and didn't make the password change on the scheduled tasks, your account could lock. - It's hard to tell but start with your event logs

by joseph moore

If I saw that all accounts on my Win2K server were locked out when I came into the office, I would immediately suspect that perhaps someone was trying to hack the server.
I hope you audit Failed Logon Events.
Check your Security log on your server. If you are auditing the logon events, then I bet you will have a bunch of failed connection attempts.
What could have happened is that someone got your user list and tried to run a password cracking program against your server using the user list.And it sounds like you are running Account Lockouts, so that if you try and log in with the wrong password several times, it locks the accounts out.
Either way, if you audit this type of thing, this will show in the Security logs.
The logs will tell from which machine these failed connection attempts came from.
HOPEFULLY they came from a machine you recognize, and not from a hacker on the Internet!
Good luck.

by sharonb033

The event log didn't show any sign of hacking and even if so the Administrator account can't get lock out.

This discussion is closed to new replies.