General discussion

Locked

NT users

By galileoave ·
Out of the blue, one of my users got locked out from our NT 4.0 server every few hours. I double checked users property and everything looked good. I even put a check mark on Account never expired. Few hours later, this user called to inform thathe got disconnected. I went to check the user property and found a check on Account Locked Out. It occurs 3 to 4 times a day.
I Went to Microsoft website, technet found nothing.

Need all the help for this problem. I ran the antivirus on the user machine and found no viruses.
Thanks,

-Lake

This conversation is currently closed to new comments.

11 total posts (Page 1 of 2)   01 | 02   Next
| Thread display: Collapse - | Expand +

All Comments

Collapse -

NT users

by JordanA In reply to NT users

Are there any services installed that use the users account? If their password has changed since the service was installed, this could cause it.

Jordan

Collapse -

NT users

by galileoave In reply to NT users

I've tried that. It didn't help.
Thanks anyway.
My last resort. Restored the old image - It worked.

Collapse -

NT users

by Joseph Moore In reply to NT users

On your NT PDC, are you auditing Failed Logon events?? That will help you to tell what is going on.
If you are not auditing, then do this:
Open User Manager for Domains on the PDC.
Click Policies -> Audit
Click the checkbox in the Failed columnfor Logon & Logoff.
Click OK and close UMforD

Ok, now wait for the user account to be locked out.
Once that happens, open the Event Viewer on the PDC, and select the Security tab.
When the account is locked out, you will have a Success Audit record Event ID 644. It will look like this:

Event Type: Audit Success
Event Source: Security
Event Category: Account Management
Event I 644
Date: 11/12/2002
Time: 12:48:23 PM
User: SYSTEM
Computer: yourPDC
Description:
User Account Locked Out:
Target Account Name: user_Account
Target Account I S-1-5-21-111111111-1111111111-1111111111-1279
Caller Machine Name: workstation_name
Caller User Name: SYSTEM
Caller Domain: NT AUTHORITY
Caller Logon I (0x0,0x3E7)
Data:


The "Caller Machine Name" field will tell you from which workstation the failed logon request was sent from. You can then go to that workstation, and find out what is going on.

Yes, it could just be a Service on that workstation that is configured to run under the user's account but with a bad password.

hope this helps

Collapse -

NT users

by galileoave In reply to NT users

I did that. User still got lockedout few days later.
Thanks.
My last resort. Restored the old image - It worked.

Collapse -

NT users

by itnetman In reply to NT users

Agree with previous answers but it could also be that the user is logged on elswhere using the old password. Is this the only PC they log onto?

Collapse -

NT users

by galileoave In reply to NT users

Asked the users and checked server manager. Found nothing.
Thank you.
My last resort. Restored the old image - It worked.

Collapse -

NT users

by Steve Penn In reply to NT users

its pretty obvious and you've probably checked this already, but in user manager you have the "hours" option which governs what time the user can log on. This is all as it should be?

Collapse -

NT users

by galileoave In reply to NT users

Checked that out also. Still did not work.
Again, thank you.
My last resort. Restored the old image - It worked.

Collapse -

NT users

by @lberto In reply to NT users

Hello there,

What kind of user is it?, is it an administrative user or just a normal user?, it seems to me that this user has changed his password and probably someone else is trying to login with his old password and it locks him out. Or it has a service that has a user depends with his old password.
First choice will be go to his computer and find out if he has a service that needs his user name and password, second choice find out if someone else tries to login with his username.

I hope it helps,

@lberto

Collapse -

NT users

by galileoave In reply to NT users

Double checked the user property. Found nothing out of the ordinary. Thank you.

My last resort. Restored the old image - It worked.

Back to Windows Forum
11 total posts (Page 1 of 2)   01 | 02   Next

Related Discussions

Related Forums