Windows Forum

Ask something
Discussion Locked

Random Lockouts after PW Changes

0 helpful
3 replies

by tracy.gaynor

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Scenario:
Microsoft Shop.
All clients either NT4 SP5+ or Win2K Pro. NT4 Domain. 1 PDC, 2 BDC.
Anyone is potenitally affected.
Affects <10 %

Has anyone run across a situation where after a user changes their password, their account gets locked out, without their knowledge or notification? Affects random NT4 and Win2K machines. Usually they are prompted to change their domain PW as it will expire in x days. Although some just CTRL-ALT-DEL and change manually.

The local machine acts fine, accepts the change, and behaves normally. But when they go to access domain resources, they are informed that their account does not have permission to access etc. Outlook prompts for UN, PW, and Domain. And at the User Manager, the account is locked out.

I keep coming back to a replication issue between DCs, but see no signs of saturation, errors, etc. And it only affects a small percentage of our users who change PW.

Anyone who can help will score major points in my (and my bosses' books). I cannot find enough of a pattern, or force a replication of the error to open a support incident and would obviously prefer not to. Redmond has too much of our funding anyway.

Thanks for your thoughts and suggestions.

Sincerely,

Tracy W. Gaynor
Network Analyst

3 replies

by stillatit

It is a replication issue -- and a race condition issue. The issue is whether the user is fast enough to hit enough domain resources which validate with non-synchronized DC's and get locked out before he tries one which HAS synchronized (which resets his count), or they all synchronize.

A lot depends on how often the DC's synchronize, and how the resources are spread out. A user at a central site hitting a mail server out on a WAN which validates to a local (to the server) BDC would cause this often. A LAN environment with only one file server and one mail server may see it only rarely.

by tracy.gaynor

Shouldn't User Account Password Changes force (push) a replication? The three DCs are all on the same subnet, 100MB, no WAN involved. We are all Direct Switched on Cisco equipment, no repeaters.

And usually, the users are not trying to get to aresource for a little while.

by gillbert

Sounds more like the affected users are logged in somewhere else and their old password is causing the lock out. This could be anything like a service running under a user account, a scheduled task running as a user (eg Windows scheduling, ntCrond...etc), someone dialling in from home...etc. I have only seen this for single users (mainly me!) and not several people. It is also hard to track down as NT lockouts can be logged in the local PC's event log rather than the PDC. NB If this is the problem and you can't find the source PC, MS have a checked verion of NETLOGON.DLL which, when installed on the PDC, logs all lock-out events.

This discussion is closed to new replies.