Windows Forum

Ask something
Discussion Locked

Event 644 not reported correctly

0 helpful
6 replies

by rsp

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I've noticed that event ID 644 (account lockout) isn't reported correctly on NT 4.0 - has anyone noticed this? It's happened on numerous systems. All the SIDs refer to user accounts. Can anyone shed light on what's happening?

Here's an example ofthe correct one:
User Account Locked Out:
Target Account Name: Account1
Target Account ID: S-1-5-21-xxxxxxxx-xxxxxxxx-xxxxxxxx-1690
Caller Machine Name: Machine1
Caller User Name: SYSTEM
Caller Domain: NT AUTHORITY
Caller Logon ID: (0x0,0x3E7)

Here's an example of a faulty log:

User Account Locked Out:
Target Account Name:
Target Account ID: SYSTEM
Caller Machine Name: S-1-5-21-xxxxxxxx-xxxxxxxx-xxxxxxxx-2687
Caller User Name: NT AUTHORITY
Caller Domain:(0x0,0x3E7)
Caller Logon ID: -

6 replies

by safurniss

Try having a look at any of your services that need to logon using an account, it looks a bit like a service has either not got the correct account and password details or the account that the service was origionally set up to use has been deleted.

by rsp

The accounts are being locked out correctly when the log is correct, but the faulty log appears to not lock the account. However, I'm not convinced that the faulty log actually contains correct information regarding the account that should be generating it.

A bit difficult to explain, but it looks like Windows' stack is overflowing somewhere because the Caller Machine Name in the faulty log is actually the Target Account ID.

by rsp

The problem I have is that the information presented in the "faulty" log is not correct - the "Caller Machine Name" contains what should be in the "Target Account ID", the "Target Account Name" is blank, etc. etc. etc.

This discussion is closed to new replies.