Account Lockout 1

[Hannie]

We are running an NT 4.0 server on which I have an admin account. For the past week, my account is being locked out every few hours. I can't find anything in the event logs to indicate attempted logons. I am confused, does anyone have any ideas please.

 

[bp1169]

If the password was changed recently you may want to make sure that no services running under that particular account are using the old password.

 

[m1ckey]

Hannie,
Do you have all the auditing on to watch for failed logon attempts??

Dan

 

[Hannie]

Thank you both for your responses. Unfortunately my password has not changed in a very long time and the auditing for successful and failed logons is turned on. I appreciate your comments.

 

[Zelandakh]

Is it possible someone is trying to hack your system? If it is an admin account try renaming it just in case.

Trawl the services one by one to see if a service is using the username to startup.

 

[jrdebug]

usually, when we do admin works on our client computers we tend to forget to logout or change the last logged-on name to a dummy, without any admin privilege. then the assigned user on that station is used to (that dumb huh!) simply typing his password and ignores to inform you about any message popping up to alert about the failed logon. at the same time, the Account Lockout check-box is active for a specified number of unsuccesful attempts. this definitely will lock-out your account.

try to remember on which station you last logged-on using your account to fix something. if i am right, i would suggest you inform your users about the EXISTENCE OF THE NETWORK.


Jeffrey Rebong
Computer Engineer/Network Administrator
jrdebug@yahoo.com