System account locked out 1

[tt523600]

hi guys!!

I found this strange entry in my event viewer under the security tab, every 5 minutes.

user account locked out
target machine name:
target account ID: System
caller machine name:
S-1-5-21-524.............etc
caller user name: NT AUTHORITY
caller domain: (0x0, 0x3E7)
caller logon ID: -

it doesn't seem like the computer is a member of the domain. Any who have an idea what this could be that is causing all these events, and perhaps a way to find out who this is.

appreciate any help.

 

[djhawthorn]

You will have a User Account Lockout policy set in User Manager, so that when someone tries to authenticate, but fails, it locks their account for x minutes.

Why the System account is locking out though, seems very wierd. MCSE NT4/W2K

 

[PeteH2]

Some more questions...

Is this network connected to the outside world ?
If so, via a firewall, ADSL or modem ?
If this happens 24 x 7, what happens if the outside world is disconnected for a period of time ?

What software runs on this network ?
What priviledges does it need ? (Pay special attention to s/ware that need to access the internet regularly: investments, Anti Virus, Time servers, etc.

Pete H

 

[tt523600]

thanks for some useful tips. I'll try them out..

 

[hendyman]

Check any scheduled tasks and services that have failed. These maybe trying to use an account that has had its password changed an therefore failing to start but keeps trying anyway.