General discussion

Locked

WIndows NT 4.0 userID lock-out

By Equintieri ·
User is on NT 4.0 SP6. His account becomes locked-out at regular intervals. There seems to be no logical explanation. He is not forgetting his PW or using a screen saver. There are no visible signs of a non-standard application. Any suggestions as to why he is being locked out?

This conversation is currently closed to new comments.

13 total posts (Page 1 of 2)   01 | 02   Next
| Thread display: Collapse - | Expand +

All Comments

Collapse -

WIndows NT 4.0 userID lock-out

by tmaclennan In reply to WIndows NT 4.0 userID loc ...

Using User Manager, select Policies/Audit and turn on logging for Logon/Logoff successes and failures. Then use the Security log to find out if there is an obvious answer.

Collapse -

WIndows NT 4.0 userID lock-out

by Equintieri In reply to WIndows NT 4.0 userID loc ...

Poster rated this answer

Collapse -

WIndows NT 4.0 userID lock-out

by dlw6 In reply to WIndows NT 4.0 userID loc ...

I have a couple of suggestions based on things I've seen that create this symptom.

First, check the Security Log on the PDC using Event Viewer and look for Failure audits of this userid attempting to logon/logoff. The time and source of these events will tell you a lot.

Someone might be mounting a denial of service attack, which is easy to do when you have automatic lockout engaged. The Security Log will tell you enough to decide if this is the case.

Is there any chance that the user might be logged onto his machine using one domain account and then opening an Exchange mailbox which belongs to another account (such as his account in a trusted domain)? Opening Exchange account X while logged into account Y, and then going idle(power management or screen saver), can sometimes cause account X to be locked out. I had a domain Y which trusted domain X and this happened every time until I told my people not to read their X e-mail from their Y accounts.

Collapse -

WIndows NT 4.0 userID lock-out

by Equintieri In reply to WIndows NT 4.0 userID loc ...

Poster rated this answer

Collapse -

WIndows NT 4.0 userID lock-out

by frank.peeters In reply to WIndows NT 4.0 userID loc ...

Two possibile causes:

1) This user is logged in at another workstation or (unattended) server with the old userid/password. Even if the machine is locked, background processes may use the old credentials and cause the lockout.
This problem can also be caused by a Terminal Server session, even a disconnected one.

2) The old userid/password were used as credentials for an NT service (Control Panel;Services;Start Up;Log on As).

Both cases can be difficult to troubleshoot, especially on larger networks.

Collapse -

WIndows NT 4.0 userID lock-out

by Equintieri In reply to WIndows NT 4.0 userID loc ...

The question was auto-closed by TechRepublic

Collapse -

WIndows NT 4.0 userID lock-out

by mhinckley In reply to WIndows NT 4.0 userID loc ...

Here's one possibility: The user logged on to a PC somewhere and his user name still comes up in the logon username field. Another user comes along, doesn't pay any attention to which username is in the field, tries to log on with his own password -tries it until the original users account is locked out. We saw this a lot on PCs with muliple users until we automatically blanked out the Username field.

Of course, you could have someone trying to get into the system with this users account.
Good luck.

Collapse -

WIndows NT 4.0 userID lock-out

by Equintieri In reply to WIndows NT 4.0 userID loc ...

The question was auto-closed by TechRepublic

Collapse -

WIndows NT 4.0 userID lock-out

by danderson In reply to WIndows NT 4.0 userID loc ...

The password probably expires. This is a setting in NT (on the server if they are logging into a network or on the local machine if it is a local password. You can change this by going into User manager, pull down the policies menu and select account. here you can set the password expiration time or lack there of.

Collapse -

WIndows NT 4.0 userID lock-out

by Equintieri In reply to WIndows NT 4.0 userID loc ...

The question was auto-closed by TechRepublic

Back to Security Forum
13 total posts (Page 1 of 2)   01 | 02   Next

Related Discussions

Related Forums