I've seen Conficker cause domain account lockouts, and it doesn't have to be from the workstation that user typically uses. Conficker has the capability to attempt hundreds of user/pass combinations from a single infected machine.
You need to determine where the account lockouts are occuring from (which workstation). I've used a nice GUI tool for this in the past. Let me check if I can dig out which program I used... (even having 3 conficker infected machines out of 1900 machines is a giant problem, ug, what a nightmare that was!!) JR Original Message: ----------------- From: Sean Rector [email protected] Date: Tue, 15 Feb 2011 11:38:23 -0500 To: [email protected] Subject: Strange account lockout situation Hello all, I've got a strange one. Laptop is running Windows XP, SP3, ISA Client, and Office 2010; it is current on all patches. AD is 2008 with 3 DC's. Mail Server is Exchange 2003, Exchange 2010 in organization, not being used yet. After random intervals, primarily when user is surfing the Internet, the user account will become locked out (5 retries causes a lockout). Workstation has been scanned for virii using Vipre Rescue (we run Vipre Enterprise), and MBAM - nothing has been found (just to cover *that* possible cause). In doing some experimenting, I've found the following: ISA Client connected fine during the entire test Outlook / Exchange may be the cause - nearly whenever the user is looking at other users' calendars, the account locks out Our Intranet web page displays the company calendar - a Public Folder calendar - and it is requesting credentials every time - from nearly everyone. The account becoming locked out is hitting 2 users only. The difference in the other user is that he's running Windows 7 Pro - everything else is the same. Ideas? Sean Rector, MCSE Information Technology Manager Virginia Opera Association E-Mail: [email protected] Phone: (757) 213-4548 (direct line) {+} Subscriptions and tickets are on sale now!? The Valkyrie?? |?? Madama Butterfly Visit us online at www.VaOpera.org or call 1-866-OPERA-VA The vision of Virginia Opera is to enrich lives through the powerful integration of music, voice and human drama. This e-mail and any attached files are confidential and intended solely for the intended recipient(s). Unless otherwise specified, persons unnamed as recipients may not read, distribute, copy or alter this e-mail. Any views or opinions expressed in this e-mail belong to the author and may not necessarily represent those of Virginia Opera. Although precautions have been taken to ensure no viruses are present, Virginia Opera cannot accept responsibility for any loss or damage that may arise from the use of this e-mail or attachments. {*} ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin -------------------------------------------------------------------- myhosting.com - Premium Microsoft® Windows® and Linux web and application hosting - http://link.myhosting.com/myhosting ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
