Account is Locked Out every 15 minutes

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hi All:

I am going completely crazy with this problem. I set-up a laptop for
one of the field technicians and now my account is repeatedly locked out.
When I check the event viewer Security logs on the server I keep seeing Event
IDs 539 and 681. It would appear the field laptop is trying to log on as me
even though the technician is logged on as himself in a different location.
I removed my account and any traces of myself from the field PC and changed
my password which took care of the problem for about a week. Now my account
is being locked so much I keep another account logged on to the server so I
can unlock my password. I have reviewed and tried to suggestions I have seen
posted but nothing seems to work. Any and all suggestions would be greatly
appreciated. Thanks.
 
Look at services and or Scheduled Tasks.

http://support.microsoft.com/default.aspx?scid=kb;en-us;273499

http://www.microsoft.com/technet/su...odVer=5.2&EvtID=539&EvtSrc=Security&LCID=1033

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Hi All:
|
| I am going completely crazy with this problem. I set-up a laptop for
| one of the field technicians and now my account is repeatedly locked out.
| When I check the event viewer Security logs on the server I keep seeing
Event
| IDs 539 and 681. It would appear the field laptop is trying to log on as
me
| even though the technician is logged on as himself in a different
location.
| I removed my account and any traces of myself from the field PC and
changed
| my password which took care of the problem for about a week. Now my
account
| is being locked so much I keep another account logged on to the server so
I
| can unlock my password. I have reviewed and tried to suggestions I have
seen
| posted but nothing seems to work. Any and all suggestions would be
greatly
| appreciated. Thanks.
|
 
Hi Dave:

There is nothing in scheduled tasks and there are no out of the
ordinary services running. I have set-up multiple PC for field techs but
only this one is giging me a problem.
 
Makes no difference. You'll need to look at the failure's "Logon Type" for
clues.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Hi Dave:
|
| There is nothing in scheduled tasks and there are no out of the
| ordinary services running. I have set-up multiple PC for field techs but
| only this one is giging me a problem.
 
I am not sure what you mean as far as logon type is concerned. The sever
logon failures tell me nothing. I just get the standard error codes for
account lockout and so forth. How am I to determine the Logon Type?
 
Should be part of the logged events on the server and or the laptop. When
you view the logged events in Event Viewer (double-click them in the
right-hand pane) in the upper right corner, third button down is a copy to
clipboard, then you can paste in the body of a reply message.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|I am not sure what you mean as far as logon type is concerned. The sever
| logon failures tell me nothing. I just get the standard error codes for
| account lockout and so forth. How am I to determine the Logon Type?
 
Here are the two error messages I receive over and over. I have edited the
domain and PC names however eveything else is as it appears:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 539
Date: 3/6/2006
Time: 1:00:52 PM
User: NT AUTHORITY\SYSTEM
Computer: DC01
Description:
Logon Failure:
Reason: Account locked out
User Name: bobbi
Domain: WORK
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: FIELDPC

_____________________________________

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 681
Date: 3/6/2006
Time: 12:59:43 PM
User: NT AUTHORITY\SYSTEM
Computer: SCPDC01
Description:
The logon to account: bobbi
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: FIELDPC
failed. The error code was: 3221226036
_______________________________
Again thanks for your help.
 
Is this a domain or workgroup? Also try from a command prompt;

net use /persistent:no
net use * /delete /y

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Here are the two error messages I receive over and over. I have edited
the
| domain and PC names however eveything else is as it appears:
|
| Event Type: Failure Audit
| Event Source: Security
| Event Category: Logon/Logoff
| Event ID: 539
| Date: 3/6/2006
| Time: 1:00:52 PM
| User: NT AUTHORITY\SYSTEM
| Computer: DC01
| Description:
| Logon Failure:
| Reason: Account locked out
| User Name: bobbi
| Domain: WORK
| Logon Type: 3
| Logon Process: NtLmSsp
| Authentication Package: NTLM
| Workstation Name: FIELDPC
|
| _____________________________________
|
| Event Type: Failure Audit
| Event Source: Security
| Event Category: Account Logon
| Event ID: 681
| Date: 3/6/2006
| Time: 12:59:43 PM
| User: NT AUTHORITY\SYSTEM
| Computer: SCPDC01
| Description:
| The logon to account: bobbi
| by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
| from workstation: FIELDPC
| failed. The error code was: 3221226036
| _______________________________
| Again thanks for your help.
 
I do not have the laptop in front of me at this moment. But I know there are
no mapped drives set-up on the laptop (or for the user) nor are there any
login scripts being used.
 
Then there's nothing more I can do for you.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|I do not have the laptop in front of me at this moment. But I know there
are
| no mapped drives set-up on the laptop (or for the user) nor are there any
| login scripts being used.
 
Back
Top