[ActiveDir] account lockout troubleshooting

[Creamer, Mark]

Hi folks, I have been trying to troubleshoot some lockout events. In every case, the event originates on the user’s own workstation (not some other user). There are no associated file object failures on the primary file server. It seems like it is application-based, but I can’t nail it down. I’ve been using Microsoft’s AL tools, including EventCombMT, but I can’t use the acctinfo.dll because the clients are Win9x.   Today I noticed for the first time that on 2 DCs, the exact same 5 login failures occurred (one example follows):   681,AUDIT FAILURE,Security,Tue Oct 07 13:13:38 2003,NT AUTHORITY\SYSTEM,The logon to account: MYUSER    by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0    from workstation: \\HIS_PC    failed. The error code was: 3221225578      I was concerned that I didn’t think it is normal that 2 DCs would log the same 5 logon failures at exactly the same times. What do you think?   Thanks,   Mark Creamer Systems Engineer Cintas Corporation http://www.cintas.com Honesty and Integrity in Everything We Do