George, This might be the problem in your particular case (I haven't taken a close look at the error) but in our experience, every time that a user has had lockout problems it's been because of:
* A PDA Auto-Synch that they forgot to change the credentials on * A scheduled task that they set up on their or another computer still using old creds * A service installed with their creds that was never updated Each of these scenarios (and more, I'm sure) will lead to lockout problems as the automatic logon fails and retries until lockout count is exceeded. It's a pain in the ass sometimes to track down. Oh, and I agree - these tools are a nice addition. Thanks for posting - reposting the link. Good luck! Rick Kingslan MCSE, MCSA, MCT Microsoft MVP - Active Directory LAN Administration - Windows 2000 West Corporation [EMAIL PROTECTED] -----Original Message----- From: George Arezina [mailto:[EMAIL PROTECTED] Sent: Wednesday, October 22, 2003 6:08 AM To: [EMAIL PROTECTED] Subject: [ActiveDir] Acct Lockout Problem Hi people, I've been trying to figure out why a certain user keeps locking their user account. They do, however, have at least 5 mapped drives to another server which is located in a different domain. No, the two domains do not have any trusts. After installing additional schema objects in ADUC I enabled an extra tab in ADUC called Additional Account Info. Great little tab, gives you an extra over view of your users. For those interested it can be downloaded at http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63- 8629-B999ADDE0B9E&displaylang=en After installing the client side of ALockout.dll which helps determine a process or application that is sending wrong credentials. I was presented with the following info below. However, I am unable to decipher the meaning of the following: Wed Oct 22 12:08:09 2003, PID: 412, Thread: 692, Image C:\WINNT\system32\svchost,***StartServiceW Failed!*** (0), Service: Service: Network Connections (C:\WINNT\System32\svchost.exe -k netsvcs), RC was: Incorrect function. (1), GLE was: Overlapped I/O operation is in progress. (997) Can anyone give me a hand please? Thanks in advance. George The info below has been generated on the client after installing ALockout.dll on the client. Wed Oct 22 12:06:45 2003, PID: 412, Thread: 400, Image C:\WINNT\system32\svchost,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:06:46 2003, PID: 440, Thread: 444, Image C:\WINNT\system32\spoolsv.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:06:51 2003, PID: 528, Thread: 524, Image C:\WINNT\System32\svchost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:06:53 2003, PID: 564, Thread: 560, Image C:\PROGRA~1\NavNT\Rtvscan.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:06:56 2003, PID: 656, Thread: 644, Image C:\WINNT\system32\MSTask.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:06:59 2003, PID: 784, Thread: 780, Image C:\WINNT\system32\svchost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:08:02 2003, PID: 332, Thread: 308, Image C:\WINNT\system32\userinit.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:08:05 2003, PID: 328, Thread: 1024, Image net,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:08:05 2003, PID: 328, Thread: 1024, Image net,ALOCKOUT.DLL - dll_process_detatch Wed Oct 22 12:08:05 2003, PID: 1024, Thread: 328, Image net,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:08:05 2003, PID: 1024, Thread: 328, Image net,ALOCKOUT.DLL - dll_process_detatch Wed Oct 22 12:08:09 2003, PID: 412, Thread: 692, Image C:\WINNT\system32\svchost,***StartServiceW Failed!*** (0), Service: Service: Network Connections (C:\WINNT\System32\svchost.exe -k netsvcs), RC was: Incorrect function. (1), GLE was: Overlapped I/O operation is in progress. (997) Wed Oct 22 12:08:11 2003, PID: 1164, Thread: 1160, Image C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:08:12 2003, PID: 1164, Thread: 1160, Image C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe,ALOCKOUT.DLL - dll_process_detatch Wed Oct 22 12:08:16 2003, PID: 1208, Thread: 992, Image C:\Program Files\Microsoft Office\Office\OSA9.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:08:19 2003, PID: 1208, Thread: 992, Image C:\Program Files\Microsoft Office\Office\OSA9.EXE,ALOCKOUT.DLL - dll_process_detatch Wed Oct 22 12:08:30 2003, PID: 332, Thread: 308, Image C:\WINNT\system32\userinit.exe,ALOCKOUT.DLL - dll_process_detatch Wed Oct 22 12:10:53 2003, PID: 808, Thread: 284, Image D:\orant\BIN\DES2K60.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:11:00 2003, PID: 1016, Thread: 1224, Image d:\orant\BIN\DWFDE60.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:11:18 2003, PID: 1044, Thread: 820, Image D:\orant\BIN\ifrun60.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:13:23 2003, PID: 820, Thread: 1044, Image D:\orant\BIN\ifrun60.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:14:06 2003, PID: 1016, Thread: 1224, Image d:\orant\BIN\DWFDE60.EXE,ALOCKOUT.DLL - dll_process_detatch Wed Oct 22 12:14:09 2003, PID: 808, Thread: 284, Image D:\orant\BIN\DES2K60.EXE,ALOCKOUT.DLL - dll_process_detatch Wed Oct 22 12:15:41 2003, PID: 440, Thread: 436, Image C:\WINNT\system32\spoolsv.exe,ALOCKOUT.DLL - dll_process_detatch Wed Oct 22 12:15:41 2003, PID: 784, Thread: 780, Image C:\WINNT\system32\svchost.exe,ALOCKOUT.DLL - dll_process_detatch Wed Oct 22 12:15:41 2003, PID: 656, Thread: 644, Image C:\WINNT\system32\MSTask.exe,ALOCKOUT.DLL - dll_process_detatch Wed Oct 22 12:25:28 2003, PID: 408, Thread: 396, Image C:\WINNT\system32\svchost,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:25:28 2003, PID: 436, Thread: 440, Image C:\WINNT\system32\spoolsv.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:25:33 2003, PID: 516, Thread: 512, Image C:\WINNT\System32\svchost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:25:35 2003, PID: 548, Thread: 544, Image C:\PROGRA~1\NavNT\Rtvscan.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:25:38 2003, PID: 644, Thread: 632, Image C:\WINNT\system32\MSTask.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:25:41 2003, PID: 800, Thread: 796, Image C:\WINNT\system32\svchost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:26:44 2003, PID: 908, Thread: 760, Image C:\WINNT\system32\userinit.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:26:46 2003, PID: 1024, Thread: 580, Image net,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:26:46 2003, PID: 1024, Thread: 580, Image net,ALOCKOUT.DLL - dll_process_detatch Wed Oct 22 12:26:46 2003, PID: 580, Thread: 1024, Image net,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:26:46 2003, PID: 580, Thread: 1024, Image net,ALOCKOUT.DLL - dll_process_detatch Wed Oct 22 12:26:51 2003, PID: 408, Thread: 524, Image C:\WINNT\system32\svchost,***StartServiceW Failed!*** (0), Service: Service: Network Connections (C:\WINNT\System32\svchost.exe -k netsvcs), RC was: Incorrect function. (1), GLE was: Overlapped I/O operation is in progress. (997) Wed Oct 22 12:26:52 2003, PID: 272, Thread: 1056, Image C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:26:53 2003, PID: 272, Thread: 1056, Image C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe,ALOCKOUT.DLL - dll_process_detatch Wed Oct 22 12:26:56 2003, PID: 1232, Thread: 1228, Image C:\Program Files\Microsoft Office\Office\OSA9.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:27:00 2003, PID: 1232, Thread: 1228, Image C:\Program Files\Microsoft Office\Office\OSA9.EXE,ALOCKOUT.DLL - dll_process_detatch Wed Oct 22 12:27:07 2003, PID: 1228, Thread: 1232, Image D:\orant\BIN\ifrun60.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:27:11 2003, PID: 908, Thread: 760, Image C:\WINNT\system32\userinit.exe,ALOCKOUT.DLL - dll_process_detatch Wed Oct 22 12:29:21 2003, PID: 1148, Thread: 832, Image D:\orant\BIN\DES2K60.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH Wed Oct 22 12:29:30 2003, PID: 768, Thread: 736, Image d:\orant\BIN\DWFDE60.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH�� George Arezina BA, A+, Net+, MCSE 2000 Information Technology Consultant National Bank of Serbia Pop Lukina 7-9, 11000 Belgrade. P E-mail: [EMAIL PROTECTED] g Phone:+381 (11) 3202-474 GSM:� +381 (63) 342-321 � List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
