Account is Locked out?

[sheel]

In domain Controller 2k server, Some reason user Accounts are locked randomly, unlocking 100 users individually is pain & no particular pattern of time. Please advise how to resolve this issue.

Thank you,

 

[Davetoo]

Check your logs for any clues as to why/how they're getting locked.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[jimrockford]

Does this happen shortly after users change their passwords?

I've seen that issue when replication wasn't working properly. When passwords expired, users would change them and then attempt to log in before replication finished. They would authenticate against their old password and lock themselves out. It was always intermittent and difficult to troubleshoot. As lander215 said, I would check the logs.

Then again, there's always the chance you've got someone trying to break into your user's accounts.

 

[dufresnem]

I am having the same problem with random users. It always seems to be about three days to a week after changing their passwords. My server is a Win2K Server fully patched to the present date.

I can't troubleshoot it because my Event logs are not logging. I see events are taking place but not displaying. I went into policies and tried to enable auditing, but still can't audit.

 

[sheel]

Again .. Some users where locked out. The event message was
The logon to account: ckillewald
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: HOME-65H00Y7J7P
failed. The error code was: 3221226036. Event ID 681

Please sdvise...

 

[Davetoo]

http://support.microsoft.com/default.aspx?scid=kb;en-us;273499

Check events prior to that to see what is going on with the users account. This just indicates they're trying to login to a locked account.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[dufresnem]

Finaly got my auditing to work and reviewed the log files.

Get this error message as well

The logon to account: <users account name >
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: < HOSTNAME >
failed. The error code was: 3221225578. Event ID 681

error code 3221225578, is User logon with misspelled or bad password.

Nothing indicates why this is happening after a password change before this event occurs.

Bizarre???? But then again, that Windows!!!!