Sorry, maybe this was covered already, but can you reproduce the problem on a workstation that doesn't belong to the user? Or are these issues isolated to the specific user on a specific machine? So if the problem is happening to JohnDoe on his PC WorkstationA, if he logs onto WorkstationB does he still experience the lockout?
Thanks Chris Bodnar, MCSE Technical Support III Distributed Systems Service Delivery - Intel Services Guardian Life Insurance Company of America Email: [email protected] Phone: 610-807-6459 Fax: 610-807-6003 From: "Rankin, James R" <[email protected]> To: "NT System Admin Issues" <[email protected]> Date: 02/15/2011 12:57 PM Subject: Re: Strange account lockout situation IIRC the event ids have changed in 2008, sorry can't post a link to the new ones as I am on a train Typed frustratingly slowly on my BlackBerry® wireless device From: Sean Martin <[email protected]> Date: Tue, 15 Feb 2011 08:47:22 -0900 To: NT System Admin Issues<[email protected]> ReplyTo: "NT System Admin Issues" <[email protected]> Subject: Re: Strange account lockout situation As someone else stated, look for failure events in the security event logs on your DCs. I use Eventcombmt from the 2003 resource kit to search for the following event IDs: 529, 644, 675, 676, 681. It searches all of your DCs for you and dumps the results into text files. Just search the text files for that username and see what client IP is generating it. Not sure if the tools works against 2008 but I would imagine there's an equivalent. - Sean On Tue, Feb 15, 2011 at 8:35 AM, Sean Rector <[email protected]> wrote: Yes, it is. Sean Rector, MCSE From: Jonathan [mailto:[email protected]] Sent: Tuesday, February 15, 2011 12:22 PM To: NT System Admin Issues Subject: Re: Strange account lockout situation Just for kicks, is the time correct (and specifically in sync with the DCs) on all systems? Jonathan - Thumb typed from my HTC Droid Incredible (and yes, it really is) on the Verizon network. On Feb 15, 2011 11:39 AM, "Sean Rector" <[email protected]> wrote: > Hello all, > > > > I've got a strange one. Laptop is running Windows XP, SP3, ISA Client, > and Office 2010; it is current on all patches. AD is 2008 with 3 DC's. > Mail Server is Exchange 2003, Exchange 2010 in organization, not being > used yet. > > > > After random intervals, primarily when user is surfing the Internet, the > user account will become locked out (5 retries causes a lockout). > Workstation has been scanned for virii using Vipre Rescue (we run Vipre > Enterprise), and MBAM - nothing has been found (just to cover *that* > possible cause). In doing some experimenting, I've found the following: > > > > ISA Client connected fine during the entire test > > Outlook / Exchange may be the cause - nearly whenever the user is > looking at other users' calendars, the account locks out > > Our Intranet web page displays the company calendar - a Public Folder > calendar - and it is requesting credentials every time - from nearly > everyone. > > > > The account becoming locked out is hitting 2 users only. The difference > in the other user is that he's running Windows 7 Pro - everything else > is the same. > > > > Ideas? > > > > Sean Rector, MCSE > > > > > Information Technology Manager > Virginia Opera Association > E-Mail: [email protected] > Phone: (757) 213-4548 (direct line) > {+} > Subscriptions and tickets are on sale now!? > The Valkyrie?? |?? Madama Butterfly > Visit us online at www.VaOpera.org or call 1-866-OPERA-VA > The vision of Virginia Opera is to enrich lives through the powerful integration of music, voice and human drama. > > This e-mail and any attached files are confidential and intended solely for the intended recipient(s). Unless otherwise specified, persons unnamed as recipients may not read, distribute, copy or alter this e-mail. Any views or opinions expressed in this e-mail belong to the author and may not necessarily represent those of Virginia Opera. Although precautions have been taken to ensure no viruses are present, Virginia Opera cannot accept responsibility for any loss or damage that may arise from the use of this e-mail or attachments. > {*} > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > --- > To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to [email protected] > with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
