Windows Forum

Ask something
Discussion Locked

Service Ticket Request Failures

0 helpful
7 replies

by rsears

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
This is a description of my problem. I have three Win2KSP2 DCs and two NT4.0SP6a BDCs all members of the same domain. I have a user whom is member of a group, domain admins who?s account locks out about twice a day. There are no events in any of the security logs to indicate what is causing the account to lock other than lots of Service Ticket Request Failures associated with this user?s account and the Win2KSP2 Pro workstation (the user?s primary location) trying to access NT4 resources throughout the network. In fact, all of the W2K Pro machines and their respective users seem to log security events of this nature but only this one account locks. I have checked to see if there are any services domain-wide running with this users logon credentials but have found none. Also, I have been closely monitoring suspicious activity for this account and machine and have seen none. Any ideas?

7 replies

by cportman

Give the current user a temporary second login, give the same access to the new user account. Wait a day and see if the old account gets locked out still - if so its gotta be a hacker.

cp

by dan_hammock

Has the user rebooted his PC? If you change your password without rebooting windows will sometimes continue using the cached logon password.

Try removing all network resouce connections(printers / network drives / email profiles) and re-adding.
Have you check to see if any apps the user is running on his workstation are saving his password?

If the above does not work I would try changing the NIC and see if the Ticket Request Failures are coming from the new or old NIC address.

Good Luck!

by fedya

Also check Task Scheduler's tasks on the workstation because they could run under the account.

Look if you have applied a filter to Event Viewer security log, at least you should see an "account lock out" event almost right after events that caused the lockout.

hope this helps,
feodor trubetskoy

This discussion is closed to new replies.