Windows Forum

Ask something
Discussion Locked

Accounts Locked-out

0 helpful
14 replies

by reference

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We recently upgraded out Win Nt 4.0 PDC to a Windows 2000 Domain Controller. Since the upgrade I am getting quit a few account lock outs happening...when a user tries to access a resource (shared drive/folder)on the 2000 D.C., they get an 'access denied' message(this doen't happen every time, and I don't have any consistent scanarios yet), once the user reboots (to re-authenticate in order to get to the resource) They get an 'incorrect password/access restricted' message, and the account is then in a locked-out state on the 2000 D.C.
I can uncheck account locked-out, and the user is fine, until this all happens again.
Any Ideas???????
As far as I know, the 2000 D.C. is acting as the PDC, through the PDC emulator, and the BDC appears tobe functioning as expected, but something is obviously not functioning properly.
Thanks for the help!

14 replies

by faisalmasood

Check your event viewer for any logs. If u find any log in it, then search MSDN library or MS KB site or EventID.net for the description / solution of the problem.

by joseph moore

Did you apply new password restrictions when you did the 2000 upgrade? Did you turn on "password must meet complexity requirements" or the "password minimim length" or "account lockout duration" or "reset account lockout after x minutes"?
It reallysounds like the Account Policies -> Password Policies and/or Account Lockout Policy in the Group Policy was enabled. This would do it. So, if user Bob's password is now set to expire Tuesday morning, and he keeps trying to log in with his old password without changing it, he will lock himself out. IF user Bob WAS logged in when his password expired, he would still be able to use his local workstation, but when he double-clicked on a network share, he would get the "access denied" message, sincehis password is expired. This happens a lot, believe me. Users see a new message to change their password, and they don't do it! They like the password they have; they don't want to change it.
So, they click No anytime they are asked to change thepassword. And they keep trying to use resources that require a valid password.
And they keep locking themselves out because of this.
So, check out Group Policy. See if it is enabled in the sections I listed above.

Hope this helps.

by reference

I'll check that, however, Nothing was changed during the upgrade, and after the user is locked-out, all I have to do is uncheck the account locked-out box, and they're fine, no password change is needed, or asked for. Passwords are set to never expire.

by reference

I'll check that, however, Nothing was changed during the upgrade, and after the user is locked-out, all I have to do is uncheck the account locked-out box, and they're fine, no password change is needed, or asked for. Passwords are set to never expire.

by poo_music

FYI, If you want to co-exist Win2k and NT4, you need to update the service pack so that everything will run smoothly, NT ? SP4 and above, Windows 2000 SP2 if you can. Make sure your PDC emulator is online and working fine. Another thing is, don?t put Infrastructure master to be together with Global Catalog, in addition, check your DNS design.
Cheers!

by reference

O.K., I'm hooked, how do I check my PDC emulator? latest Sp's on both machine 2k-sp2, 4.0-sp6a. and you lost me on the infrastructur master....??? where else would it go if I only have one nt2k server? And lastly, my DNS is not running correctly, (Idon't have the four "-msdcs, _tcp, ..etc, I'm looking ito this, but I think it has to do with an invalid computer name...I won't get into it now..)but, do you really think this could cause the specific problem I'm having?
Thanks for the help!!

by iulian costache

I had the same problem. Remove the "account lockout treshold" from the "account lockout policy" in "group policy"->computer configuration.
Just set it to "0 invalid logon attempts". This is not recommended but it will clear the problem until you complete upgrading your network.

Note: this is the "default domain policy"

by reference

Thanks, but I would really like to find the problem, not just cover it up. If I don't find a resolution though, this is what I will have to do!

by reference

Thanks, but I would really like to find the problem, not just cover it up. If I don't find a resolution though, this is what I will have to do!

by jda-cpa

We had this problem as well. Here is the solution.

On the Domain Controller server
Open a command prompt and type in:
net config server /autodisconnect:-1

This will set the autodiconnection feature used by the operating system to never or infinite and will stop users from getting the above error. What is happening is the autodisconnection feature is disconnecting the users from the disk drives and when the user tries to reconnect, their account gets locked out because the system is unable to log them in again after the disconnection has occurred.

by reference

I had tried that command, and it seemed to help, but I still got reports of a lockout here and there, We fixed the problem by upgrading the nt 4.0 server to 2000 server. Thanks for all the help

This discussion is closed to new replies.