General discussion


Need help on "Account locked out"

By vt399 ·
Hi everyone,

My company has a network with Windows 2000, 2003 servers and Windows XP workstations. My logon account kept lock out randomly several times a day (Failure code 0x18), sometimes it locked few minutes after I unlocked it. Downloaded tool from Microsoft (Lookoutstatus.exe), traced and found out my account locked out because of random Windows XP workstations in a computer lab, I did check the workstations and some of them I never log on before.

Some PCs in that lab were imaged by me a year ago(using IBmaster, IBclient and after blasting I ran "NewSID" software). Everything working fine after that until I changed my logon password a couple weeks ago.

Please, help. Thank you very much.

Best regards,


This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

Collapse -

by KhaosTheery In reply to Need help on "Account loc ...

My first thoughts are that the lockout is comming from cached user credentials under a profile of the logged on user at those lab machines. Find the user thats logged in and delete and recreate that profile.

Collapse -

by Mehul Bhai In reply to Need help on "Account loc ...

There is a possibility that the services in the systems in the lab is using your logon at stratup of the service. If this is the case then change the services logon as to "Local System Account" which should be the normal case. If the services are using your logon then after you change your password the account lockout normally happens as the services will be still using the old password is still used to logon as in the services. This happens when you have a password lockout policy in the domain. We faced similar problems at our organization with some users. The problem was solved after we changed the services to logon as "Local System Account". Please check the services in your systems in the lab. There may be also many other things in the system which use your logon to start like in IIS, etc.
Best of luck.

Collapse -

by vt399 In reply to

I did check: all PCs were set up to logon as "Local System Account". Thanks

Collapse -

HI, I'm facing the same problem

by monuforyou In reply to

Hi Mehul,
I'm also facing the same problem.
One user's id getting locked very frequently.
After checking on DC it was found that its getting locked from another pc thats a server which is accessed by the user for some IIS related work.But now she doesn't access that and i've deleted her profile.
BUt if i unlock her account and try to login to that server with her id then it still shows "account is locked".
I thought it could be from IIS and i stopped It also but account was still getting locked out. Now some members of her team access that server remotely.i dont know if somebody has given her old credentials somewhere..
The security log shows event id 529 and some details as:
Logon Failure:
Reason: Unknown user name or bad password
User Name: pooja.dhamija
Logon Type: 4
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: HCL-MS0Y3LVHW5F
Caller Domain: NT AUTHORITY
Caller Logon I (0x0,0x3E4)
Caller Process I 2324
Transited Services: -
Source Network Address: -
Source Port: -

please help me out.


Collapse -

VT399 Please Contact me in reguard to your solution.

by Flashtube105 In reply to Need help on "Account loc ...

You posted a problem on 02/02/2006, with the title of "Need help on "Account locked out".
What was your final resolution. We are having the same problem. Thanks!

Collapse -

Determining Account Lockout reason

by DRendolf In reply to Need help on "Account loc ...

Take a look at "NetWrix Account Lockout Examiner" tool. This tool determines the reason for account lockout automatically by doing a lot of routine work (monitor event logs, scan for cached passwords in services/scheduled tasks/etc, etc.)

Collapse -

NetWrix Account Lockout Examiner

by ITsteve13 In reply to Need help on "Account loc ...

Hi Victor,
Sorry to hear about the struggles that you, and anyone else experiencing similar account lockout problems have endured. While I don?t have the information necessary to give you a definitive explanation as to why you were, and may still be experiencing account lockouts, I can assure you that the NetWrix Account Lockout Examiner is capable of providing you with an answer, as well as a solution, that will allow you to quickly log back into your account and avoid similar issues in the future.
The NetWrix Account Lockout Examiner is useful and cost-effective in that it enables users to return to productivity as quickly as possible with minimal or no intervention from the help desk. After providing IT administrators with a real-time notification of the account lockout, the Account Lockout Examiner troubleshoots the issue on its own, investigating potential causes of the account lockout, such as mapped network drives or disconnected remote desktops, and then allows users to proactively resolve the issue through a web-based or E-mail console that is used to unlock the given account.
Check out the NetWrix Account Lockout Examiner at and download the evaluation version.
I hope this helps,
Stephen Schimmel, Product Manager, Stephen Schimmel

Related Discussions

Related Forums