account lockouts

[forumit]

I'm experiencing random account lockouts all of a sudden. Users then get errors like - the system detected a possible attempt to compromise security. Scanned computers for virusses and spyware etc.Dont see anything related to this in the event logs.Only one site on the WAN is having this problem.

 

[itsp1965]

Do you have auditing of objects enabled as part of your security policy. This would start logging events in the security event log.
Never heard of Windows generating this type of message (the system detected a possible attempt to compromise security). Was it a pop-up generated by a particular program?

 

[PCollinsVan]

We had an issue like this, looked in Event Viewer, Security, and saw tons of failed logins all coming from one computer. It had some kind of malware that was attempting logins to the domain, and after x number of failed attempts, the respective account gets locked out. We disconnected that pc but haven't investigated it yet. Funny our centralized Trend Micro didn't pick it up.

 

[Lemon13]

you might be infected by win32/conficker

http://support.microsoft.com/?scid=kb;en-us;962007&x=13&y=11

M. Knorr

MCSE, MCTS, MCSA, CCNA

 

[forumit]

Users get "the system detected a possible attempt to compromise security" while trying to open a map network drive.I'm aware of win32/conficker but we are running latest MS patches and SEP. Why is only one site having this problem. Using software program Altools - account lockout status to track these lockouts. It appears that accounts are getting lockout on a different DC not on this site.

 

[forumit]

Does any have an idea why user accounts will get locked out.Users are not locking themselves out. Our AD team suggests that it is a local computer problem.

 

[pagy]

Use the lockoutstatus tool to get more info about the locked accounts;

http://www.microsoft.com/downloads/...familyid=D1A5ED1D-CD55-4829-A189-99515b0E90F7

I read an excellent blog article not too long ago as well about troubleshooting account lockouts. I'll see if I can find it again..

Paul
MCTS: Exchange 2007, Configuration
MCSA:2003
MCSE:2003
MCITP:Enterprise Administrator

RFC 2795 - The Infinite Monkey Protocol Suite (IMPS)

http://www.faqs.org/rfcs/rfc2795.html

Difficult takes a day, impossible takes a week

 

[pagy]

http://smtp25.blogspot.com/2009/10/what-is-causing-my-account-to-get.html

Paul
MCTS: Exchange 2007, Configuration
MCSA:2003
MCSE:2003
MCITP:Enterprise Administrator

RFC 2795 - The Infinite Monkey Protocol Suite (IMPS)

http://www.faqs.org/rfcs/rfc2795.html

Difficult takes a day, impossible takes a week

 

[forumit]

I'm using the lockoutstatus tool and its shows that account is locked out on the DC's. According to this utility the lock is coming from the same DC everytime someone gets locked out - not DC at our site.I dont have access to DC to check event logs etc. Server team suggests that it's a local pc problem. Only users at one site gets locked out which means its a site specific DC problem?

 

[pagy]

Without access to that DC's security event log tracking down the problem will be much harder.. Could you ask someone with access to the DC to either check the security log for you or ask them to dump the log out to a file and send it to you?

Paul
MCTS: Exchange 2007, Configuration
MCSA:2003
MCSE:2003
MCITP:Enterprise Administrator

RFC 2795 - The Infinite Monkey Protocol Suite (IMPS)

http://www.faqs.org/rfcs/rfc2795.html

Difficult takes a day, impossible takes a week

 

[forumit]

Got this error from event log on one workstation where user is experiencing account lockouts.

Source:LSASRV
Category: SPNEGO
Event: 40960

The Security System detected an attempted downgrade attack for server cifs/servername.mydomain.local. The failure code from authentication protocol Kerberos was "The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested.
(0xc0000234)".

Busy investigating this but found nothing so far.