General discussion


Accnt. Locked Out afterSuccessful Login

By CSCTech ·
I have three users who keep getting locked out of their accounts after successfull logins. The computers are all running XP Pro SP1 and they are logging into an NT 4 server.

When I view the event logs I can see that the user logs on successfully but then the acccount is locked out between 3-20 minutes later. I have not found any unknown username or bad password entries in event log.

Has anyone else experieinced this problem and found a solution for it? We never had this problem before we changed the bad password count to 4 attempts from 7 attemps.

I have reimaged one of the computers and the problem is still happening.

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

Collapse -

by LiamE In reply to Accnt. Locked Out afterSu ...

Just a wild stab in the dark here.. have you checked the times on all the machines concerned? Invalid timestamps can cause no end of problems - but I have to say I've not seen this happen.

Collapse -

by CSCTech In reply to Accnt. Locked Out afterSu ...

I was monitoring the event logs again today and noticed the entry below. I am trying to figure out what would try to log in as a batch logon. Microsoft states this is rarely used in the Windows enviornment and I am wondering if this might have something to do with the problem.
Logon Failure:
Reason: Unknown user name or bad password
User Name: User Name
Domain: Domain Name
Logon Type: 4
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: Computer Name
I have checked the time on the computer but it is was synchronized with the server.

Collapse -

by CSCTech In reply to Accnt. Locked Out afterSu ...

I finally figured out the problem. I had thought that the bad logon attemps counter was reset after a 24 hour period or something like that. I don't know if this is standard but here the counter doesn't get reset until the account is locked out and then unlocked.

It is set to lockout after three bad password attempts. I found that kronos jobs were setup in the Task Scheduler (Scheduled Tasks)and they are set to log in as the user with the password cached.

When the users had to change their passwords the cached password did not get updated. I just had all the users with the problem reset the cached password and none of the users are getting locked out now.

Related Discussions

Related Forums