Also could be custom service developed by someone and they used their userid/password for the credentials for the service.
I am asked periodically to investigate the cause of this and I search the domain controllers security logs for 539 and 644 events. Part of the message field in the events is the workstation name involved. You'll likely find more than one machine involved. One of them will be the machine with the out of data password being used for the manual drive map or login with old password, etc... They're fairly easy to resolve as long as you're logging, even with 100+ domain controllers. Bjelke John A Contr AFRL/VSIO <[EMAIL PROTECTED]> @mail.activedir.org on 01/15/2003 09:07:43 AM Please respond to [EMAIL PROTECTED] Sent by: [EMAIL PROTECTED] To: "'[EMAIL PROTECTED]'" <[EMAIL PROTECTED]> cc: Subject: RE: [ActiveDir] User's Account Locked out Every morning Manual drive mappings with old passwords.. -----Original Message----- From: John F. Hann [mailto:[EMAIL PROTECTED]] Sent: Wednesday, January 15, 2003 8:05 AM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] User's Account Locked out Every morning Logged in another PC under an old password.... -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kevin Felker Sent: Wednesday, January 15, 2003 9:01 AM To: [EMAIL PROTECTED] Subject: [ActiveDir] User's Account Locked out Every morning Every morning I have to unlock one of my user's accounts because it is locked out every morning. Does anyone know what could be causing this? Thanks Kevin ******************* PLEASE NOTE ******************* This E-Mail/telefax message and any documents accompanying this transmission may contain privileged and/or confidential information and is intended solely for the addressee(s) named above. If you are not the intended addressee/recipient, you are hereby notified that any use of, disclosure, copying, distribution, or reliance on the contents of this E-Mail/telefax information is strictly prohibited and may result in legal action against you. Please reply to the sender advising of the error in transmission and immediately delete/destroy the message and any accompanying documents. Thank you. List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
