Account Lock Outs

[maeling]

For some reason today our users are being periodically locked out. Their doesn't seem to be a logical reason. I have been unlocking accounts all morning. The users do not seem to be in breach of any policy although we do not have any group policies defined. The windows 2000 network is 12 months old and this is the first time I have seen anything like this. I thought it may be virus related but I cannot find anything suspect at all. Help !

 

[Japskunk72]

Have you checked your event logs. you might be running out of client access licenses if you have added any more computers or clients in the last 12 months.

 

[maeling]

Thanks for the reply however we operate per seat licensing. The event logs are displaying some erros which I am currently investigating in Knowledge Base Article 306091 related to the SAM database. I just wondered before I begin my endless journey of reading article whether anybody had experienced something similar and new a quick fix ?
Thanks again

 

[ajroxit]

a brute force attack maybe? set up auditing of AD, account login, FAILURE and see what happens. could be some malicious little puke fooling around.
good luck
AJ

 

[quell]

We had an employee do this a while back. Decided it would help out to run retina on our network and let me know what holes are needed to be patched. He forgot to uncheck the setting about testing user accounts.

 

[maeling]

We have now resolved the issue without knowing whta the cause was. We loaded an up to date security patch and rebooted the server and it resolved it.