General discussion

Locked

Users getting dropped from network

By LauraA ·
I have 3 users out of about 70 on our Windows 2000 domain that continually get knocked off the network. I have a mixed environment of 98, 2000 and xp machines; these 3 have 98. My other 98 users are not having problems. I have more than enough CAL's (I had been told that 2000 and xp machines would bounce a 98 if enough licenses weren't available). On one of the users I swapped out the network card and physically moved the machine to rule out the cabling. They log in just fine at the beginning of the day, but while connected, they may try to open, print or save to the network and can't get to the network folders and have to reboot. My security event logs are full of these event ids for these 3 users everyday. Any suggestions/ideas?

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event I 529
Date: 3/9/2004
Time: 12:18:21 PM
User: NT AUTHORITY\SYSTEM
Computer: WHO-SERVER
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: AHENDERSON
Domain: WHO-GB
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: \\ALISA_PIII

This conversation is currently closed to new comments.

13 total posts (Page 1 of 2)   01 | 02   Next
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by jschein In reply to Users getting dropped fro ...

Have you tried microsoft's Zero Administration Kit for win 98?

Collapse -

by LauraA In reply to

haven't tried, yet. Will try and see if it helps.

Collapse -

by tamj123 In reply to Users getting dropped fro ...

This event record indicates an attempt to log on using an unknown user account or a valid user account but with an incorrect password. An unexpected increase in the number of these audits could represent an attempt by someone to find user accounts and passwords (such as a "dictionary" attack, in which a list of words is used by a program to attempt entry).

Common causes for invalid logon events:
- Forgotten passwords, someone is entering the wrong password.
- An unauthorized individual is trying to gain access to the network.
- There is a persistent network connection with an invalid password.
- There is a service using a user account with an invalid password.
- Trust relationship has been broken.

MS Q290706 says that remote automatic logon operation to a computer that is running Terminal Services with a long user name or password is not supported. If this is attempted, the logon fails and this event gets recorded.


This event has also been observed on IIS web servers that have NTLM authentication enabled. If an anonymous user connects to the web server through MS Internet Explorer, the browser will try first to authenticate the user using the login credentials of that user. Since there is no such user configured in the security database of the web server, the authentication attempts fails and the browser will then attempt to connect anonymously.

Collapse -

by tamj123 In reply to

also,
As per MS Q287639, if a user on a computer that is running Microsoft Windows 95 or Microsoft Windows 98 attempts to log on to a Windows 2000-based domain and is validated by a domain controller that has that user's account locked, but the primary domain controller operations master (also known as flexible single-master operations or FSMO) has the account unlocked, the logon attempt is denied. The problem was fixed by SP3.

Collapse -

by LauraA In reply to

I know its not a wrong password, coz the user gets in in the morning and is bounced out through out the day. Not using Terminal Services or and IIS web server (those were the only knowledgebase references I could find too). Any way to determine if the trust relationship is broken? Should I try by disabling the account and creating a new user account for one user to try?

Collapse -

by LauraA In reply to Users getting dropped fro ...

My servers have all of the current updates and service packs applied.

Collapse -

by tamj123 In reply to Users getting dropped fro ...

yes, crated an test account

Collapse -

by LauraA In reply to

New user account didn't change the user getting kicked off the network.

Collapse -

by jsulliva In reply to Users getting dropped fro ...

We have experienced similar problems, but our symptom presented itself as a mapped network drive not available. See Microsoft Knowledge Base Article 278558 for more information.
We added the patch, 278558USA8.EXE, to our Helpdesk Menu so when Windows 98 users experience the problem,they can apply the patch to their workstation.

Collapse -

by LauraA In reply to

Got the patch from MS; made a server autodisconnect settings changes and that seems to have worked. I hadn't even installed the patch on the systems in question yet. I was out of town for a week and they haven't been thrown off the network nor have my event logs shown the logon/logoff errors for at least the past 10 days.

Back to Windows Forum
13 total posts (Page 1 of 2)   01 | 02   Next

Related Discussions

Related Forums