Help, Urgent! Events 539/681 Accounts Locked out!

[jlancton]

Starting this morning, all of my accounts are getting locked out. The server is Win2K, SP3. The audit log shows a different netbios named machine trying to login to every account causing the lockouts. I've found a vbscript to unlock them all quickly, but I want to secure the server against this threat. I've read about the RestrictAnonymous setting, but it isn't recommended for a DC, which this server is. It's the only Windows server we have, and as such has file and print responsibilities as well as e-mail. Can anyone suggest something?

Thanks in advance...

-Jeff

 

[lbreimyer]

If you used a real-time host-based change detection software, you could prevent your current lockout problem. The software will monitor all of your servers in real-time and notify you of any changes (as well as providing the option to automatically reverse the changes - i.e. unlocking each server).

Personally, I use Pedestal Software INTACT. It solves all of my change detection problems (very comprehensive and customizeable) and reasonably priced (especially considering that I usually opt for freeware).