If that's the case, security logs on the DCs should contain the relevant information (if failure auditing is enabled). This site seems to have a good list of the various event ids...
http://www.windowsecurity.com/articles/Event-IDs-Windows-Server-2008-Vista-Revealed.html - Sean On Tue, Feb 15, 2011 at 12:50 PM, Sean Rector <[email protected]>wrote: > I think you may have it on it – Mapped Drives and cached credentials. I > think they’ve all updated their passwords recently. > > > > Sean Rector, MCSE > > > > *From:* Steven Peck [mailto:[email protected]] > *Sent:* Tuesday, February 15, 2011 3:48 PM > > *To:* NT System Admin Issues > *Subject:* Re: Strange account lockout situation > > > > net use x: \\server\share /persistent:yes > If they have a mapped resource, the local OS will cache the credentials but > not necessarily update them. It may be that Windows 7 is 'helping' with the > persistent connection. I would check drive and printer mappings while you > are pulling your hair out. > > Another possibility is logged in somewhere else with the old credentials, > terminal server, wireless (iPhone with old credentials). > > Steven Peck > http://www.blkmtn.org > > > On Tue, Feb 15, 2011 at 11:46 AM, Sean Rector <[email protected]> > wrote: > > I haven’t tested that yet. > > > > Sean Rector, MCSE > > > > *From:* Christopher Bodnar [mailto:[email protected]] > *Sent:* Tuesday, February 15, 2011 1:04 PM > > > *To:* NT System Admin Issues > *Subject:* Re: Strange account lockout situation > > > > Sorry, maybe this was covered already, but can you reproduce the problem on > a workstation that doesn't belong to the user? Or are these issues isolated > to the specific user on a specific machine? So if the problem is happening > to JohnDoe on his PC WorkstationA, if he logs onto WorkstationB does he > still experience the lockout? > > Thanks > > Chris Bodnar, MCSE > Technical Support III > Distributed Systems Service Delivery - Intel Services > Guardian Life Insurance Company of America > Email: [email protected] > Phone: 610-807-6459 > Fax: 610-807-6003 > > > > From: "Rankin, James R" <[email protected]> > To: "NT System Admin Issues" <[email protected] > > > Date: 02/15/2011 12:57 PM > Subject: Re: Strange account lockout situation > ------------------------------ > > > > > IIRC the event ids have changed in 2008, sorry can't post a link to the new > ones as I am on a train > > Typed frustratingly slowly on my BlackBerry® wireless device > ------------------------------ > > > *From: *Sean Martin <[email protected]> > *Date: *Tue, 15 Feb 2011 08:47:22 -0900 > *To: *NT System Admin Issues<[email protected]> > *ReplyTo: *"NT System Admin Issues" <[email protected]> > > *Subject: *Re: Strange account lockout situation > > As someone else stated, look for failure events in the security event logs > on your DCs. I use Eventcombmt from the 2003 resource kit to search for the > following event IDs: 529, 644, 675, 676, 681. It searches all of your DCs > for you and dumps the results into text files. Just search the text > files for that username and see what client IP is generating it. > > Not sure if the tools works against 2008 but I would imagine there's an > equivalent. > > - Sean > > On Tue, Feb 15, 2011 at 8:35 AM, Sean Rector <[email protected]> > wrote: > Yes, it is. > > > > Sean Rector, MCSE > > > > *From:* Jonathan [mailto:[email protected]] * > Sent:* Tuesday, February 15, 2011 12:22 PM > * > To:* NT System Admin Issues* > Subject:* Re: Strange account lockout situation > > > > Just for kicks, is the time correct (and specifically in sync with the DCs) > on all systems? > > Jonathan - Thumb typed from my HTC Droid Incredible (and yes, it really is) > on the Verizon network. > > On Feb 15, 2011 11:39 AM, "Sean Rector" <[email protected]> wrote: > > Hello all, > > > > > > > > I've got a strange one. Laptop is running Windows XP, SP3, ISA Client, > > and Office 2010; it is current on all patches. AD is 2008 with 3 DC's. > > Mail Server is Exchange 2003, Exchange 2010 in organization, not being > > used yet. > > > > > > > > After random intervals, primarily when user is surfing the Internet, the > > user account will become locked out (5 retries causes a lockout). > > Workstation has been scanned for virii using Vipre Rescue (we run Vipre > > Enterprise), and MBAM - nothing has been found (just to cover *that* > > possible cause). In doing some experimenting, I've found the following: > > > > > > > > ISA Client connected fine during the entire test > > > > Outlook / Exchange may be the cause - nearly whenever the user is > > looking at other users' calendars, the account locks out > > > > Our Intranet web page displays the company calendar - a Public Folder > > calendar - and it is requesting credentials every time - from nearly > > everyone. > > > > > > > > The account becoming locked out is hitting 2 users only. The difference > > in the other user is that he's running Windows 7 Pro - everything else > > is the same. > > > > > > > > Ideas? > > > > > > > > Sean Rector, MCSE > > > > > > > > > > Information Technology Manager > > Virginia Opera Association > > E-Mail: [email protected] > > Phone: (757) 213-4548 (direct line) > > {+} > > Subscriptions and tickets are on sale now!? > > The Valkyrie?? |?? Madama Butterfly > > Visit us online at www.VaOpera.org <http://www.vaopera.org/> or call > 1-866-OPERA-VA > > The vision of Virginia Opera is to enrich lives through the powerful > integration of music, voice and human drama. > > > > This e-mail and any attached files are confidential and intended solely > for the intended recipient(s). Unless otherwise specified, persons unnamed > as recipients may not read, distribute, copy or alter this e-mail. Any views > or opinions expressed in this e-mail belong to the author and may not > necessarily represent those of Virginia Opera. Although precautions have > been taken to ensure no viruses are present, Virginia Opera cannot accept > responsibility for any loss or damage that may arise from the use of this > e-mail or attachments. > > {*} > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > > > --- > > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > > or send an email to [email protected] > > with the body: unsubscribe ntsysadmin > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to [email protected] > with the body: unsubscribe ntsysadmin > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to [email protected] > with the body: unsubscribe ntsysadmin > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to [email protected] > with the body: unsubscribe ntsysadmin > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to [email protected] > with the body: unsubscribe ntsysadmin > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to [email protected] > with the body: unsubscribe ntsysadmin > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to [email protected] > with the body: unsubscribe ntsysadmin > > > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to [email protected] > with the body: unsubscribe ntsysadmin > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to [email protected] > with the body: unsubscribe ntsysadmin > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
