I have a user (XP Pro SP2)whose account keeps getting locked out with Event ID 40960. The source is LSASRV and category is SPNEGO negotiator. The AD environment is mixed, i.e. W2K3 and W2K. The event ID mentions that too many invalid attempts to login or change a password were made against our application server (standalone server). User changed her password recently ok and this may be key to the solution. The application server is running IIS and ERP software but authentication is domain name user and password reliant. I unlock the account (or it will unlock itself after 30 minutes) but the same thing can happen again maybe later on.
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
SPNEGO negotiator 1
- Thread starter PJOL
- Start date
-
1
- #2
There is a comment which mentions "SPNEGO" near the end of the page.
- Thread starter
- #3
Thanks: I checked out the link and read through the appropriate information carefully. I downloaded the 'lockout status' tool and ran the tool against the user in the domain. There was one dc in the domain for this user with positive Bad Password Counts. I had to reboot this dc anyway because of Microsoft security updates I applied recently and I always suspected that my problem was related to an older password being cached or user policy not being updated somehow.
So far so good...no bad password counts after the reboot on the dc.
So far so good...no bad password counts after the reboot on the dc.
- Status