Grr... Looked on all three DCs (all are 2008 R2), and none of these show up. On the Exchange 2003 server, I see lots of 680's.
Update - the 3rd person whom I thought was resolved is experiencing it too - Windows XP, Office 2003. The one thing that is the same between these three - they're BB users. But my other two BB users are not experiencing this. Ahh frustration! Sean Rector, MCSE -----Original Message----- From: [email protected] [mailto:[email protected]] Sent: Tuesday, February 15, 2011 11:54 AM To: NT System Admin Issues Subject: RE: Strange account lockout situation Per my last message, here are a few of my notes... Check for the following: 1. Repeated entries (10 or more in a row) of 675 Failure Audits (likely to show Client IP address of infected machine AND attempted accts its locking out) 2. Success Audits of 644 to see what is being locked out 3. Failure audits of 680 (this may not show/help much) Infected machines will probably have the following services disabled: automatic updates service, bits, workstation, etc. Use the NetWrix account logon tool to determine lockouts (this was a HUGE help in tracking down the machines) If you are multiple sites like I was (10 different locations), checking ALL domain controllers at every sites was a royal pain. NetWrix account logon tool REALLY helped with this. You may not have a Conficker issue... but the account lockout symptons are conficker-like. :( JR Original Message: ----------------- From: Sean Rector [email protected] Date: Tue, 15 Feb 2011 11:38:23 -0500 To: [email protected] Subject: Strange account lockout situation Hello all, I've got a strange one. Laptop is running Windows XP, SP3, ISA Client, and Office 2010; it is current on all patches. AD is 2008 with 3 DC's. Mail Server is Exchange 2003, Exchange 2010 in organization, not being used yet. After random intervals, primarily when user is surfing the Internet, the user account will become locked out (5 retries causes a lockout). Workstation has been scanned for virii using Vipre Rescue (we run Vipre Enterprise), and MBAM - nothing has been found (just to cover *that* possible cause). In doing some experimenting, I've found the following: ISA Client connected fine during the entire test Outlook / Exchange may be the cause - nearly whenever the user is looking at other users' calendars, the account locks out Our Intranet web page displays the company calendar - a Public Folder calendar - and it is requesting credentials every time - from nearly everyone. The account becoming locked out is hitting 2 users only. The difference in the other user is that he's running Windows 7 Pro - everything else is the same. Ideas? Sean Rector, MCSE Information Technology Manager Virginia Opera Association E-Mail: [email protected] Phone: (757) 213-4548 (direct line) {+} Subscriptions and tickets are on sale now!? The Valkyrie?? |?? Madama Butterfly Visit us online at www.VaOpera.org or call 1-866-OPERA-VA The vision of Virginia Opera is to enrich lives through the powerful integration of music, voice and human drama. This e-mail and any attached files are confidential and intended solely for the intended recipient(s). Unless otherwise specified, persons unnamed as recipients may not read, distribute, copy or alter this e-mail. Any views or opinions expressed in this e-mail belong to the author and may not necessarily represent those of Virginia Opera. Although precautions have been taken to ensure no viruses are present, Virginia Opera cannot accept responsibility for any loss or damage that may arise from the use of this e-mail or attachments. {*} ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin -------------------------------------------------------------------- myhosting.com - Premium Microsoft(r) Windows(r) and Linux web and application hosting - http://link.myhosting.com/myhosting ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
