OregonSteve
MIS
Greetings-
Single Site, Single Domain; 3 DCs; Windows 2003 Server; XP pro workstations w/ SP2. A user reported not being able to log in; checking their account revealed it was locked out. This problem has been happening to apparently random users on our network starting about two months ago. Looking at the Security logs on the DCs reveals entries like the one below, indicating the account is locked out, but I can never find ones indicating a bad password attempt.
We had all our users change passwords about 4 months ago with a maximum password age of 180 days.
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 675
Date: 12/18/2005
Time: 9:30:45 AM
User: NT AUTHORITY\SYSTEM
Computer: DC1
Description:
Pre-authentication failed:
User Name: AtkinsJ
User ID: MyDomain\AtkinsJ
Service Name: krbtgt/MyDomain
Pre-Authentication Type: 0x2
Failure Code: 0x18
Client Address: 10.35.27.23
In this case, this entry appears anywhere from 2 to 12 times A SECOND. They stop abruptly at 09:34:00 We've seen this on other accounts over the past couple of months, but never to this extent. What could be generating this message in such mass quantities??? If I can find this out, I'm sure I'll be able to resolve the main problem that's affecting other users.
I've found several posts in this forum presenting user lockout problems, but have never seen a post that contains a solution... Let's be the first to crack this nut!!!
Thanx
OregonSteve
"..You should never, never doubt what nobody is sure about." -Willy Wonka
Single Site, Single Domain; 3 DCs; Windows 2003 Server; XP pro workstations w/ SP2. A user reported not being able to log in; checking their account revealed it was locked out. This problem has been happening to apparently random users on our network starting about two months ago. Looking at the Security logs on the DCs reveals entries like the one below, indicating the account is locked out, but I can never find ones indicating a bad password attempt.
We had all our users change passwords about 4 months ago with a maximum password age of 180 days.
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 675
Date: 12/18/2005
Time: 9:30:45 AM
User: NT AUTHORITY\SYSTEM
Computer: DC1
Description:
Pre-authentication failed:
User Name: AtkinsJ
User ID: MyDomain\AtkinsJ
Service Name: krbtgt/MyDomain
Pre-Authentication Type: 0x2
Failure Code: 0x18
Client Address: 10.35.27.23
In this case, this entry appears anywhere from 2 to 12 times A SECOND. They stop abruptly at 09:34:00 We've seen this on other accounts over the past couple of months, but never to this extent. What could be generating this message in such mass quantities??? If I can find this out, I'm sure I'll be able to resolve the main problem that's affecting other users.
I've found several posts in this forum presenting user lockout problems, but have never seen a post that contains a solution... Let's be the first to crack this nut!!!
Thanx
OregonSteve
"..You should never, never doubt what nobody is sure about." -Willy Wonka