Windows Forum

Ask something
Discussion Locked

NT users

0 helpful
11 replies

by galileoave

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Out of the blue, one of my users got locked out from our NT 4.0 server every few hours. I double checked users property and everything looked good. I even put a check mark on Account never expired. Few hours later, this user called to inform thathe got disconnected. I went to check the user property and found a check on Account Locked Out. It occurs 3 to 4 times a day.
I Went to Microsoft website, technet found nothing.

Need all the help for this problem. I ran the antivirus on the user machine and found no viruses.
Thanks,

-Lake

11 replies

by jordana

Are there any services installed that use the users account? If their password has changed since the service was installed, this could cause it.

Jordan

by galileoave

I've tried that. It didn't help.
Thanks anyway.
My last resort. Restored the old image - It worked.

by joseph moore

On your NT PDC, are you auditing Failed Logon events?? That will help you to tell what is going on.
If you are not auditing, then do this:
Open User Manager for Domains on the PDC.
Click Policies -> Audit
Click the checkbox in the Failed columnfor Logon & Logoff.
Click OK and close UMforD

Ok, now wait for the user account to be locked out.
Once that happens, open the Event Viewer on the PDC, and select the Security tab.
When the account is locked out, you will have a Success Audit record Event ID 644. It will look like this:

Event Type: Audit Success
Event Source: Security
Event Category: Account Management
Event ID: 644
Date: 11/12/2002
Time: 12:48:23 PM
User: SYSTEM
Computer: yourPDC
Description:
User Account Locked Out:
Target Account Name: user_Account
Target Account ID: S-1-5-21-111111111-1111111111-1111111111-1279
Caller Machine Name: workstation_name
Caller User Name: SYSTEM
Caller Domain: NT AUTHORITY
Caller Logon ID: (0x0,0x3E7)
Data:

The "Caller Machine Name" field will tell you from which workstation the failed logon request was sent from. You can then go to that workstation, and find out what is going on.

Yes, it could just be a Service on that workstation that is configured to run under the user's account but with a bad password.

hope this helps

by galileoave

I did that. User still got lockedout few days later.
Thanks.
My last resort. Restored the old image - It worked.

by itnetman

Agree with previous answers but it could also be that the user is logged on elswhere using the old password. Is this the only PC they log onto?

by galileoave

Asked the users and checked server manager. Found nothing.
Thank you.
My last resort. Restored the old image - It worked.

by steve penn

its pretty obvious and you've probably checked this already, but in user manager you have the "hours" option which governs what time the user can log on. This is all as it should be?

by galileoave

Checked that out also. Still did not work.
Again, thank you.
My last resort. Restored the old image - It worked.

by @lberto

Hello there,

What kind of user is it?, is it an administrative user or just a normal user?, it seems to me that this user has changed his password and probably someone else is trying to login with his old password and it locks him out. Or it has a service that has a user depends with his old password.
First choice will be go to his computer and find out if he has a service that needs his user name and password, second choice find out if someone else tries to login with his username.

I hope it helps,

@lberto

by galileoave

Double checked the user property. Found nothing out of the ordinary. Thank you.

My last resort. Restored the old image - It worked.

This discussion is closed to new replies.