Desktop·25,117 discussions

I have a user (XP pro) who gets locked out of her account every day.

Locked

Every evening after the user leaves I go into AD and unlock her account the next morning she is locked again. I’ve made a completely new profile on the pc and in AD and she is still getting locked out. I’ve unplugged the pc’s power to rule out the Auto startup we have running and had no luck.
Any ideas are MUCH appreciated

Topic

Clarifications

In reply to I have a user (XP pro) who gets locked out of her account every day.

Clarifications

example of test CCNA2

In reply to I have a user (XP pro) who gets locked out of her account every day.

please help me how can i get example test of ccna 2 v2.1

Easy

In reply to example of test CCNA2

you can’t.

CCNA

In reply to example of test CCNA2

Hey Jewuk,

The best place I have gotten my test examples for CCNA is: http://www.actual-exams.com/

I had taken my CCNA 2 twice then found this site through a friend. Studied the material and passed. Hope the best..

Thanks
Baltierra

what’s the lockout policy

In reply to I have a user (XP pro) who gets locked out of her account every day.

and what are in the domain security logs? is there a lot of failed logon attempts?

typically wrong user name or password lockout policy is anywhere from 10 to 30 minutes. complete lockout requires an admin to go into AD Users and Computers/her user account and manually lock the account.

That’s just it,

In reply to what’s the lockout policy

her account is being locked out before she ever attempts to login. The account is setup the same exact way as all other users and no other user has had the issue.

That’s just it,

In reply to what’s the lockout policy

her account is being locked out before she ever attempts to login. The account is setup the same exact way as all other users and no other user has had the issue.

virus. as CG says, what is in the event logs please

In reply to I have a user (XP pro) who gets locked out of her account every day.

a virus or a hacker fits your symptoms.

Ran numerous scans and it is virus free.

In reply to virus. as CG says, what is in the event logs please

The event logs are free of any “failed logon attempts” or any other warnings for that matter besides 1 printer issue 2 weeks ago. I doubt it is a hacker, besides the one user on the pc having login issues the pc is trouble free.

not going to guess all day

In reply to Ran numerous scans and it is virus free.

just to have you say you already tried it
call microsoft

Guffaw! “Hello, this is the helpdesk…Hello?”

In reply to not going to guess all day

“Goodbye.”

Has this always happened?

In reply to I have a user (XP pro) who gets locked out of her account every day.

Or can you track down when it started to something like a password change? This can cause this issue if the user has a scheduled task that’s trying to run with her as the user or a drive mapping on another PC is trying to re-establish using the old password.

Edited to add some helpers…
http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=7af2e69c-91f3-4e63-8629-b999adde0b9e

The user started with the company about a month ago,

In reply to Has this always happened?

everything was fine for a few days but I discovered a typo in her acct and corrected it, the issue started shortly after. I then deleted the acct completely off the pc and AD and recreated it with the correct spelling. I’ll have to check the scheduled tasks and the drive mappings but as far as aI know her mapped drives are all accessable.
Thanks for the ideas so far and keep them coming.
Brian

Any other ideas?

In reply to The user started with the company about a month ago,

I checked scheduled tasks and there where none and her mapped drives opened without issue.

Saved passwords

In reply to Any other ideas?

Does the client have a saved password in XP?
Go into the control panel, then users, click on her name, then on the Advanced tab to the right. Then click on Manage Passwords. If she has an old password stored in there (proxy, mapped drive, etc) then it will lock her out all the time.
Not sure this is your issue, but its one more thing to look at.

Good luck,

Kevin

Saved passwords

In reply to Any other ideas?

Does the client have a saved password in XP?
Go into the control panel, then users, click on her name, then on the Advanced tab to the right. Then click on Manage Passwords. If she has an old password stored in there (proxy, mapped drive, etc) then it will lock her out all the time.
Not sure this is your issue, but its one more thing to look at.

Good luck,

Kevin

Multiple log ons?

In reply to Any other ideas?

Perhaps this user is logged onto more than one workstation? It doesn’t have to be a scheduled task that is causing the problem – simply being logged onto another workstation with an expired password could result in account lock outs.

Good thinking.

In reply to Multiple log ons?

It turns out theat the user was at a different cube when she started and was still logged on. Now I just have to wait for tomorrow morning to verify that was the cause. I can’t imagine what else it could be.
Thanks!!!

User logged in Elsewhere

In reply to Good thinking.

I had something like this before, the user is logged in elsewhere on another PC. Most properly a PC that is not shutdown everyday and is still on all this time. Check the Event logged on the AD server, that is how I found out.

Was this the problem?

In reply to Multiple log ons?

I’m just curious because I had the same problem once, only I was the user logged in on a machine I was working and had changed my password before going back to it….

Follow-up??

In reply to Was this the problem?

Dontcha hate it when someone submits a question, asks for help, takes your suggestion, and then doesn’t follow up to tell you if it worked? Where’s the learning opportunity in that?

Brian, where ever you are, you’re a tech-tease.

This worked for me…

In reply to Multiple log ons?

Make sure there is noone on the network with teh same Computer name.

Lete me know if you find a solution to your problem.

Jeremy

License

In reply to The user started with the company about a month ago,

Please check your License, check or you have enough.

AD is your problem

In reply to The user started with the company about a month ago,

Try making sure your Active directory has the correct info then for an update across your servers. This new replication should fix the error.

try this

In reply to Has this always happened?

This can happen when the user is logged into two different machines and changes the password on one but does not log out of the other. Make sure the user is not logged in to two different machines. Hope this helps.
jd

Account Expiration

In reply to try this

Another thing to look at is make sure that the account is not set to expire after one day on the AD setup. Just a thought.

Service associated with the account

In reply to Account Expiration

possible:
Is there a service associated with the account. If so, and the user has changed her password since the service was setup you’ll have to either change the password for the service to match the current password or associate the service with another account.

OFFICE PRANK

In reply to I have a user (XP pro) who gets locked out of her account every day.

Has she been annoying any of her collegues lately?

One brilliant practical joke is to go to a non-descript terminal and put her logon name in and “alsdfhas” “asldfhafd” and “qlretjh” as her password three consecutive times.

Most systems will then lock the account.

Brilliant “joke” to play on your collegues, especially if the first time you do it, wait behind their desk and after it says “Account locked out” go up to them and tell them Bill Jones from Personnel/HR was here asking about them……….

-AS

Office Prank 2

In reply to OFFICE PRANK

A much funnier and less destructive prank is to use the Win XP screen rotation feature on a user’s PC when their back is turned. This is achieved using ‘CTRL + ALT + (arrow key)’, the arrow key you use (up, down, left, right) is the edge of the screen where the top edge of the image will be. Very perplexing if you don’t know about this feature.

You wouldn’t believe the number of people who do this accidentally when trying to press ‘CTRL + ALT + DEL’ and then phone the helpdesk in a panic because their screen has turned upside down!!!

CTRL + ALT + UP

In reply to Office Prank 2

I can’t get this to work!

Is this on XP pro still?

-AS

Account Lockout

In reply to I have a user (XP pro) who gets locked out of her account every day.

If the user has manually mounted a drive on another PC with his or her User ID and an old password the account will be locked out after a few hours.

account lookout, how do you find prior drive mapping?

In reply to Account Lockout

We have the same thing with one of our users. A long time user, but we just instituted password changing after 30 days.
So if she has a drive mapping ‘out there’ how can I find the machine that the mapping is on.
Like a needle in a haystack we have about 700 machines on the network. How can I narrow it down?

Try this…

In reply to account lookout, how do you find prior drive mapping?

You ought to be able to check her logons on your DC’s event log. Once you know which machines she has used its easy, just check those workstations for the drive mappings.
RDP to the workstation and log in as the user.
(Which may mean changing her password again…)

Another way would be to set her a logon script that lists the mapped drives to a file. Run that for a few days and see what you get.

Passwords

In reply to I have a user (XP pro) who gets locked out of her account every day.

Many users type the password incorrectly or do not remember it. How many tries does she get before being locked out? Is she in the habit of always having the Caps Lock on? Also with many systems requiring several passwords – Domain, AS/400, Firewall, etc. it is easy to confuse even appearantly savvy users as to which password is used when.

Has user login into server or other computer?

In reply to I have a user (XP pro) who gets locked out of her account every day.

Has the user logged into another computer or server (terminal Server) since last password change? I don’t suppose you have any logging or alert system turned on that would tell you which machine is making the calls (You using sitescope)? The Lockout could be caused by a service or schedule task running with user’s old credentials (I hold company lock out record for that one).

This was most common

In reply to Has user login into server or other computer?

A user who “forgot” they had logged on to another computer, failed to logoff AND had changed their password in the interim has been my most common cause of this issue. Usually they only “remember” after you find the offending workstation.

Check the Domain Controller security logs to find what may be a 529 error or a Kerberos error 0x18 and may have the user’s ID in it. That will yield the IP address of the station that is trying to authenticate with a bad password and triggering the lockout.

Another possibility is the user mapped a persistent static drive with their credential while another user was logged in on another machine – and subsequently changed their password.

Again back to the Domain Controller security logs to find the offending IP.

Saved passwords?

In reply to I have a user (XP pro) who gets locked out of her account every day.

Perhaps at some point she saved a password that authenticates her to some domain resource such as authenticating to a file share or IIS site. We have a analytical cell counter instrument that uses IIS.

Things that worked for me…..

In reply to I have a user (XP pro) who gets locked out of her account every day.

This has only happened after a password change for my users, including myself.

It gets fixed by doing the following, not sure which one.

Turn off cache mode in MS Outlook.
Delete and recreate any printers or drive mappings that were created locally versus through domain login.

I have a user (XP pro) who gets locked out of her account every day.

In reply to I have a user (XP pro) who gets locked out of her account every day.

Check for any services that might be running with that account, i had a similar situation and that was the problem

Issy

Lock out in AD

In reply to I have a user (XP pro) who gets locked out of her account every day.

Please make sure the user does a proper logout procdure from the desktop or laptop client. Once you have confirmed, check the users has got no logout script in AD that runs when the users logout. let me know.

Thanks

Check your server tapes.

In reply to I have a user (XP pro) who gets locked out of her account every day.

Do you have your server, set to backup each evening? It may be resetting the lock-out with the backups, if you get my drift??

Service ot process on her system or other system

In reply to I have a user (XP pro) who gets locked out of her account every day.

Sorry if this has been posted already, just scnned titles.

If you have checked out everything on the AD with her account, then something must be attempting a login during the evening. I would check processes on her system if they are using her specfic login credentials or other systems that might have services or processes using her credentials. You can review the security logs on the Domain controller to get the exact times of attempted logins. There should be a specific number of fail attempts and that number should match your domain password policy. good luck

Close any open mapi connections

In reply to I have a user (XP pro) who gets locked out of her account every day.

my guess is that the user changed his/her password. Is the user part of a microsoft exchange org? if so, i would try to make sure all of his/her mapi sessions are closed on the exchange server. Outlook sometimes has the tendency to keep multiple sessions (up to 32 sometimes) open and this can be caused due to outlook cache mode most of the times, or at least from what i have seen. The idle mapi sessions keep the old password settings that are held in cache and they lock the user out because it is attempting to keep that connection open.

see your exchange admin, the only ways i know of how to close open mapi sessions is to dismount the store or reboot the actual server. depending on your company policy these options may not be feasible. However, its worth a shot if you can.

good luck.

P.S. scroll up a few notches to a post by cawallace007. His post is right on track with other possible fixes! 😛

Mapi connections

In reply to Close any open mapi connections

We are also having the same issues, however it is happening to all of our VPN users (about 15). We have bumped the connections from 32 to about 47 and that is not solving the problem, as the max is reached almost daily. We had been rebooting the server, but need to know why this is happening. Could VPN be the culpret? Is anyone else having this issue

Replace the keyboard

In reply to I have a user (XP pro) who gets locked out of her account every day.

There may be a loose nut behind it.

internet authentication?

In reply to I have a user (XP pro) who gets locked out of her account every day.

I know this may sound a bit too simple but i have had a similar thing happen at my school where a staff user had a G-Mail account that ran at startup and wanted to access the net immediately to check for new mail. If the logon passsword was changed then the G-Mail program, at next logon, trying to access the internet via our proxy server, would lock her account until she remembered to update her internet password – ticking that “Remember my password” can be a real nuisance sometimes.

Some windows service is runing under her user context

In reply to I have a user (XP pro) who gets locked out of her account every day.

That’s usually what it is and is causing the lockout due to authentication errors.

Mapi connections

In reply to Some windows service is runing under her user context

Do you know what we could try to fix the issue? We are running VPN 4.0 and outlook 2003
Thank you

Hire a proper IT Admin :D

In reply to Mapi connections

Thats the solution 😀

[Author]

Replies