Account lockouts

[John]

Hello,

We had some auditors in house that decided to implement
the account lockout feature for Windows Server 2k. They
assigned it to lockout after three failed attempts. I
have disabled the lockout services. We have several
people now, whose accounts are locked out every day,
sometimes 4 to 10 times. We are currently running
Service Pack 3. Any suggestions would be greatly
appreciated so I can stop unlocking accounts all day....

Thanks.

John

 

[Miha Pihler]

Here are some tools that should help you out troubleshooting your problem.
http://microsoft.com/downloads/deta...9C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

It is likely they are trying to e.g. re-connect to mapped hard disk
somewhere on network using old password or they are trying to run some
service or scheduled task also with old password...

 

[John]

Thanks Mike,

Was thinking the same thing about an app trying to
reconnect with an old domain password. Any ideas or
tests that I can run that might show what app they are
trying to run?

Thanks again,

John.

 

[Miha Pihler]

John,

check out the tools I sent you link to... Here is it again ...
http://microsoft.com/downloads/deta...9C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

One of the tools does:
ALockout.dll. On the client computer, helps determine a process or
application that is sending wrong credentials.

 

[John]

Mike,

Thanks again. I ran the tools on one of the clients and
figured out that the password issues were coming from
Services.

 

[Miha Pihler]

Cool. I am glad I was able to help you out

Mike