Account LOCKS..

  • Thread starter Thread starter Ed
  • Start date Start date
E

Ed

Is anybody here of Account being LOCK every 7 minutes?
Its happening to us.. Looks like a virus but having
trouble find answers. We are using AD 2003 SR4..

Thanks
Ed
 
Looks like someone is using some hacking Tool for cracking passwords

Check the event log (security) for account lockouts, if you see
several logon attempts from the same computer you most likely have
someone trying to crack passwords.

Event id 644 is common in this scenarios

If you find which computer that is doing the attacks but dont know the
ip or mac address you can fire up Network Monitor to start tracing
in/out traffic to the DC:s and then compare the event id with the data
from Network Monitor (timre stamp)

regards
Johan Arwidmark

Windows User Group - Nordic
http://www.wug-nordic.net
 
This could be something trying to reauthenticate with an old
username/password, maybe an application of some kind. I've come across this
before. Was the users password recently changed?
Check for any scheduled apps, also check email clients.
 
Back
Top