Random Account Lockout

[briteeyez]

Hi

User accounts in active directory are randomly locked out. I would like to find a solution.

Security Logs on domain controlers show...

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 537
Date: 11/05/2004
Time: 10:32:19 a.m.
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description: An error occurred during logon

and

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 681
Date: 11/05/2004
Time: 10:32:19 a.m.
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
The logon to account: USEREXAMPLE
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: \\WORKSTATIONEXAMPLE
failed. The error code was: 3221226036

and...

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 539
Date: 11/05/2004
Time: 10:32:19a.m.
User: NT AUTHORITY\SYSTEM
Computer: FS06
Description:
Logon Failure:
Reason: Account locked out
User Name: USEREXAMPLE
Domain: SKYNZ
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: \\WORKSTATIONEXAMPLE

Debug logging for the Net logon services shows...


1. Our company runs all versions of Microsoft Windows. 200 and XP Workstation, 2000 and 2003 Server.

2. Our Domain Controlers are all 2000 Server with service pack4.

3. Our domain policy is set such that 3 bad attempts locks an account out.

Can anyone please help me. What can I do to solve this problem?

 

[alepore]

Chances are that you have a computer locked with the user's old credentials. Go to the PDC Emulator in your domain and check the audit logs in Event Viewer. That should point you in the right direction.