RE: Win2K Pro client / NT domain Account Lockouts

[Heavner, Charlie]

Title: Message

Yea, I found that Q article yesterday...the Q263821article fix refers to Win2K Servers and I've stated that we don't have any in our domain yet. Altho', this Q article is compelling enough to find out from our server team folks if there are any known replication problems on the DCs.

 

I think that I can safely say that it is not a problem with my Win2K Pro image that I'm deploying because it would be happening on all of my machines instead of sporadically across the PCs that we've already deployed. That Account Locks happen when a User isn't changing their password or even working on the PC while it's turned on seems to indicate that their is something going on on the NT domain controllers.

 

Would you agree?

Charlie

 

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 06, 2001 3:41 PM
To: [EMAIL PROTECTED]
Subject: FW: Win2K Pro client / NT domain Account Lockouts

I don't know if this is your problem, but there is a post-SP2 patch that fixes (or alleges to fix) a similar problem.

 

See http://support.microsoft.com/support/servicepacks/windows/2000/win2000_post-sp2_hotfixes.asp and specifically http://support.microsoft.com/support/kb/articles/q263/8/21.asp?ID=263821.

 

-----Original Message-----
From: Heavner, Charlie [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 06, 2001 1:48 PM
To: NT System Admin Issues
Subject: RE: Win2K Pro client / NT domain Account Lockouts

I had instances where a User:

wasn't using a password protected screen saver and waiting on a mainframe job to complete just running a terminal emulator

I have had Users get their new PC, automatically get prompted to change their password because Support Staff had to log in with the User's ID to setup the PC and immediately after the password change the account locked. Some suggest that the account locked because the domain password and the locally cached password used for the screen saver password were out of sync but I don't buy that. I would happen every time.

 

-----Original Message-----
From: Martin Blackstone [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 06, 2001 2:44 PM
To: NT System Admin Issues
Subject: RE: Win2K Pro client / NT domain Account Lockouts

Are you SURE it isn't user error?

-----Original Message-----
From: Heavner, Charlie [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 06, 2001 11:31 AM
To: NT System Admin Issues
Subject: Win2K Pro client / NT domain Account Lockouts

I'm deploying Win2K Pro in a Mixed environment (WinNT domain).

Randomly, Win2K Pro clients will experience an Account Lockout.

I think that it is an NTLMv2 replication problem across DCs but don't have a good handle on how to prove it.

Anybody ever experience this and how did you resolve it?

 

I've not changed any of the default security settings in the LGPO on my clients.

We aren't running any Win2K servers yet.

 

Thanks for any help,

Charlie

 

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm