<PC was infected with some sort of malware> randex and rbot will
do that. nasty.
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Peter Jessop
Sent: Wednesday, May 18, 2005 12:52 AM
To: [email protected]
Subject: Re: [ActiveDir] Accounts Locked
I had a similiar problem a few weeks ago. The only
difference was that things did not return to normal on their own. I came in one
day and found that about 80% of the domain accounts were locked out and more
were being locked out by the minute.From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Peter Jessop
Sent: Wednesday, May 18, 2005 12:52 AM
To: [email protected]
Subject: Re: [ActiveDir] Accounts Locked
After briefly panicking I solved the problem in the following way.
1. Unlocked the locked out accounts with Unlock (www.joeware.net)
2. By viewing Failed logon attempts on the DCs, I found that they all came from the same PC.
3. PC was infected with some sort of malware.
Regards
Peter Jessop
