Sounds like you've got the conflicker virus running somewhere. We had that one for a while. Many locked accounts. Check the account you are using on the server to make sure it isn't locked out. If it is, you wont be able to use it to unlock anyone. We had to use the "administrator" account to unlock my account so I could unlock others. I'm pretty sure the "administrator" account can't be locked out. We also found a script that we could run to unlock all of them. Saved lots of time. Also, if you look at the event logs you should see where the infected computer has failed login for different user accounts. It was event 539 on server 2003. Not sure what the server 08 equivalent event number is.
-----Original Message----- From: Kennedy, Jim [mailto:[email protected]] Sent: Tuesday, March 10, 2009 12:07 PM To: NT System Admin Issues Subject: RE: Account lockouts I should have added 2008 DC's. Seeing this in 3 of the 5 DC's. The killer is I can't unlock the locked accounts. > -----Original Message----- > From: Kennedy, Jim [mailto:[email protected]] > Sent: Tuesday, March 10, 2009 11:53 AM > To: NT System Admin Issues > Subject: Account lockouts > > I am getting hammered with these in the event log: > > The SAM database was unable to lockout the account of USERNAME due to a > resource error, such as a hard disk write failure (the specific error > code is in the error data) . Accounts are locked after a certain number > of bad passwords are provided so please consider resetting the password > of the account mentioned above. > > > And accounts are getting locked out left and right, others are not. I > have reset the passwords on some of them and disabled/enabled and they > still remain locked out. > > At first glance you/I might think a dictionary attack, but it feels > more like Kerberos blowing up....... > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
