FreeBusy problem/Exchange Admin account locked out
My Exchange servers developed an interesting problem over the weekend. When I got to work this morning the Exchange Administrator account was locked out. The following events are logged around the time when the account gets locked out and I am unable to find any information in the Knowledge Base that seems to apply. (names change to protect the innocent) In the Security log of my AD controllers: Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 537 Date: 02/17/2003 Time: 8:19:18 AM User: NT AUTHORITY\SYSTEM Computer: AD1 Description: Logon Failure: Reason: An unexpected error occurred during logon User Name: Domain: Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name: - In the application log of each of my 3 Exchange 2000 SP3 servers: Event Type: Error Event Source: MSExchangeFBPublish Event Category: General Event ID: 8213 Date: 02/17/2003 Time: 7:56:51 AM User: N/A Computer: MAIL1 Description: System Attendant Service failed to create session for virtual machine MAIL1. The error number is 0xc0070775. A search of the Knowledge Base on Event ID 537 returns no useful articles and the KB articles on 8213 don't seem to apply. I cannot seem to find an event that lead up to this problem. Has anybody seen this before or could you point me in the right direction? Thanks, -Matt Matthew Bailey LAN Engineer CSK Auto, Inc. [EMAIL PROTECTED] Office: (602) 631-7486 Fax: (602) 294-7486 Chaos reigns within. Reflect, repent, and reboot. Order shall return. _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Account locked out
One way to make it stop locking out while you're investigating is set it back to what it was in user manager. That way you have x days to figure out where else they are logged on. -Original Message- From: James Liddil [mailto:[EMAIL PROTECTED]] Sent: Monday, March 04, 2002 11:18 AM To: Exchange Discussions Subject: Account locked out Exchange 2000 SP2. I have a user account that is all of a sudden being locked out. I discovered the first instance on Friday when the user could not log in. I checked the account to day and found it was locked out again. What logging can I turn on to figure out why this is happening. Other suggestions also welcome. Jim Liddil _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Account locked out
Dokken Im the hunter /Dokken -Original Message- From: Hunter, Lori [mailto:[EMAIL PROTECTED]] Sent: Thursday, March 07, 2002 11:20 AM To: Exchange Discussions Subject: RE: Account locked out One way to make it stop locking out while you're investigating is set it back to what it was in user manager. That way you have x days to figure out where else they are logged on. -Original Message- From: James Liddil [mailto:[EMAIL PROTECTED]] Sent: Monday, March 04, 2002 11:18 AM To: Exchange Discussions Subject: Account locked out Exchange 2000 SP2. I have a user account that is all of a sudden being locked out. I discovered the first instance on Friday when the user could not log in. I checked the account to day and found it was locked out again. What logging can I turn on to figure out why this is happening. Other suggestions also welcome. Jim Liddil _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
Account locked out
Exchange 2000 SP2. I have a user account that is all of a sudden being locked out. I discovered the first instance on Friday when the user could not log in. I checked the account to day and found it was locked out again. What logging can I turn on to figure out why this is happening. Other suggestions also welcome. Jim Liddil _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
Re: Account locked out
Sounds like someone else is trying to login as them. Try turning on auditing and log login success and failures to see if that is what's happening. - Original Message - From: James Liddil [EMAIL PROTECTED] To: Exchange Discussions [EMAIL PROTECTED] Sent: Monday, March 04, 2002 12:18 PM Subject: Account locked out Exchange 2000 SP2. I have a user account that is all of a sudden being locked out. I discovered the first instance on Friday when the user could not log in. I checked the account to day and found it was locked out again. What logging can I turn on to figure out why this is happening. Other suggestions also welcome. Jim Liddil _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Account locked out
Either someone else is trying to logon as that user. One common thing we have seen is that people will use their personal accounts for service accounts (these are developers, not IT). After they change the password, the service account will do something that requires authentication. -Original Message- From: James Liddil [mailto:[EMAIL PROTECTED]] Sent: Monday, March 04, 2002 9:18 AM To: Exchange Discussions Subject: Account locked out Exchange 2000 SP2. I have a user account that is all of a sudden being locked out. I discovered the first instance on Friday when the user could not log in. I checked the account to day and found it was locked out again. What logging can I turn on to figure out why this is happening. Other suggestions also welcome. Jim Liddil _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Account locked out
On this site, we have people that move around all over the place. Today, they could be logged into a turnaround machine downtown, tomorrow they could be logged into their machine 45 minutes away, out in the field. A lot of times, they log into the turnaround machine, lock it and walk away to go do something else and forget to come back and log out. Then, when they change their password, that machine that is still logged in keeps locking them out. If you have SMS 2.0 running on your site, you can get a list of the computers this account is logging in from. Then go check each of those machines. Jim Blunt -Original Message- From: James Liddil [mailto:[EMAIL PROTECTED]] Sent: Monday, March 04, 2002 9:18 AM To: Exchange Discussions Subject: Account locked out Exchange 2000 SP2. I have a user account that is all of a sudden being locked out. I discovered the first instance on Friday when the user could not log in. I checked the account to day and found it was locked out again. What logging can I turn on to figure out why this is happening. Other suggestions also welcome. Jim Liddil _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
