Networks

Ask something
Question Locked

Server 2003 keeps dropping passwords

0 helpful
9 replies

by clark1

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Here is the situation:

Server 2003 with AD running, all the latest patches installed.

We have 1 user who almost every day cannot get logged into the domain. We have reset his password several times, it is set not to expire, no login hour restrictions, nothing we can find that would cause this issue. It only happens with 1 user.

Anybody have any clue as to why this would be occurring??

Oh and no he is not forgetting his pw.

9 replies

by reb00t

ne. At this point, I would think there is something suspicious with his machine (possible virus or hacking).

I would unplug it from the network and detain it until you try the user on another machine for a few days. While unplugged, run an up-to-date antivirus and anti-spyware tools on it. If it's easier to rebuilt his computer, do it. Take his entire computer out of the equation.

Also, make sure your security auditing is set to audit all success and failed events. Look through your security log in eventviewer on the users logon server to see if any other success or failed attempts are being made using his account.

by clark1

had him use a different workstation to log on and he was able to log on without any issues.

I checked the security audit on the server after I posted and it was showing him as logging off of his pc, and a successful log on when he used the other machine. No other attempts have been made from his machine/account other than when he has attempted to log on.

As far as virus/hacking issues we have active antivirus on both the individual machines as well as the server running, web filtering software (websense) running with a very restrictive user policy as well as on the email server ANY email that comes in with attachments are manually scanned before being allowed thru to the individual users.

The only issue I can think of is he put a second drive in his machine from the shelf and the issue started then. I had him move anything he needed to the server ie: Documents he created etc... and we are going to wipe that drive and see if that makes any difference.

by clark1

I was looking in the computers container and I could not find the computer object for this pc, I had him try to log in as the domain admin (we work in the same office, he just is not quite up to speed) and it would not let the domain admin log in either so I had him login as the root admin to the pc, change the pc name to what it SHOULD be (tech2), removed it from the domain, rebooted, logged back in local, rejoined to the domain, rebooted and had him login as himself and it took right off. Checked the computer container and lo and behold there is now an object for this pc in the container. I had him log out and I am going to try to login now and see what happens.

If successful then I think the issue has been resolved.

Bingo, he got right in, so I think issue has been resolved, thanks for your input.

by retro77

So the issue doesnt happen on the other 'new' machine?

by clark1

able to logon to the domain just fine on a different machine.

by clark1

After further investigation the machine was not listed in AD under computers, just had to login locally, remove the pc from the domain, rename it, and rejoin the domain. It now shows in the domain and no issues logging in now.

This discussion is closed to new replies.