Random password expiration?

[SteveLord]

Have seen this a few times in our offices here and I am not sure what to make of it since I am still a little fresh with AD and Win2k3.

The other day I came into work and tried to login to my XP Pro computer and it said my password was wrong. Well obviously I knew this couldn't be right, but it wouldn't let me in.

I ended up just resetting my password through my user profile in AD and was able to continue. I was told this happens once in a while to another person for no reason at all.

There is no password expiration set for either of us. I have admin rights, while the other employee does not.

Is this a bug where a user's password will randomly not work forcing a reset?

Thanks.



----------
IT Admin
Iowa Board of Medicine

 

[Davetoo]

What do the Security logs say on the server?

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[SteveLord]

Showing as "Failure Audits."

From

7:29:42am

Logon attempt by:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:	administrator
 Source Workstation:	IOWADSMFP60
 Error Code:	0xC000006A

--
7:29:42am

Logon Failure:
 	Reason:		Unknown user name or bad password
 	User Name:	administrator
 	Domain:		IOWADSMFP60
 	Logon Type:	7
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	IOWADSMFP60
 	Caller User Name:	IOWADSMFP60$
 	Caller Domain:	IOWA
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID:	404
 	Transited Services:	-
 	Source Network Address:	127.0.0.1
 	Source Port:	0

--
7:29:52am

Logon attempt by:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:	servin
 Source Workstation:	IOWADSMFP60
 Error Code:	0xC0000064

--
7:29:52am
Logon Failure:
 	Reason:		Unknown user name or bad password
 	User Name:	servin
 	Domain:		IOWADSMFP60
 	Logon Type:	7
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	IOWADSMFP60
 	Caller User Name:	IOWADSMFP60$
 	Caller Domain:	IOWA
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID:	404
 	Transited Services:	-
 	Source Network Address:	127.0.0.1
 	Source Port:	0

After this, I went in with another account to reset.

The night and early morning prior showed a few of these randomly.

Logon Failure:
 	Reason:		Account currently disabled
 	User Name:	
 	Domain:		
 	Logon Type:	3
 	Logon Process:	Authz   
 	Authentication Package:	Kerberos
 	Workstation Name:	IOWADSMFP60
 	Caller User Name:	IOWADSMFP60$
 	Caller Domain:	IOWA
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID:	836
 	Transited Services:	-
 	Source Network Address:	-
 	Source Port:	-

----------
IT Admin
Iowa Board of Medicine

 

[Davetoo]

System had a screensaver up and someone entered the wrong password locking the account...

http://www.windowsecurity.com/articles/Logon-Types.html

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[SteveLord]

I either CTRL ALT DEL and LOCK my computer or I shut it down before I go home. No one else uses it, but me. It locks itself after idling for 20 minutes.

Are you saying the cleaning lady is to blame? =)


----------
IT Admin
Iowa Board of Medicine

 

[Davetoo]

Well, you can read for yourself via that link that logon type 7 is an attempt to enter a password through the screen saver function...so someone is trying to access the system.

Cleaning lady...fellow employee...someone is attempting to gain access to your server. I'd investigate who and why, quickly.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!