Account Lockout Event 675

I am seeing a very strage issue on my network. My user account and others
are being locked out multiple times per day. After checking the Security
logs on my DC and using the various lockout tools, I notice that dozens of
computers in my location make attempts to logon with my user credentials.
The same computer doesn't keep trying but lots of them just try once,
eventually locking out my account. I have checked the obvious, services
using my account, mapped drives and everything else I read in the Account
Lockout white paper. Anyone have any ideas on what this could be?

djc8484
Sun Feb 13 19:47:02 CST 2005

Anyone one of you big bad MVPs want to help with this one or is this out of
your league?

"djc8484" wrote:

> I am seeing a very strage issue on my network. My user account and others
> are being locked out multiple times per day. After checking the Security
> logs on my DC and using the various lockout tools, I notice that dozens of
> computers in my location make attempts to logon with my user credentials.
> The same computer doesn't keep trying but lots of them just try once,
> eventually locking out my account. I have checked the obvious, services
> using my account, mapped drives and everything else I read in the Account
> Lockout white paper. Anyone have any ideas on what this could be?

Joe
Mon Feb 14 11:12:36 CST 2005

Scheduled Tasks ???

Obviously, SOMETHING is trying to login as the user(s) ... By the security
event logs, it should tell you where, when and by what ...

"djc8484" <djc8484@discussions.microsoft.com> wrote in message
news:00C98986-3FAD-4F8E-96D9-67C4D0462E79@microsoft.com...
> Anyone one of you big bad MVPs want to help with this one or is this out
of
> your league?
>
> "djc8484" wrote:
>
> > I am seeing a very strage issue on my network. My user account and
others
> > are being locked out multiple times per day. After checking the
Security
> > logs on my DC and using the various lockout tools, I notice that dozens
of
> > computers in my location make attempts to logon with my user
credentials.
> > The same computer doesn't keep trying but lots of them just try once,
> > eventually locking out my account. I have checked the obvious, services
> > using my account, mapped drives and everything else I read in the
Account
> > Lockout white paper. Anyone have any ideas on what this could be?

Steven
Mon Feb 14 12:00:51 CST 2005

It could be more difficult to track down if type three network logons were
the reason for the failed logons which means the logon attempts came for a
different computer than what was indicated in the failed account logons in
the security logs of the domain controllers. However with netlogon logging
on the domain controllers, it would be possible to trace back the computer
or computers that initiated the failed logons via looking for entries for
via transitive logon. It could be an automated scan such as a program
checking for patch levels that is failing and triggering the failed logons
on multiple computers. --- Steve



"Joe Rookie" <nospam@dontemailme.com> wrote in message
news:O8vMfhrEFHA.1188@tk2msftngp13.phx.gbl...
> Scheduled Tasks ???
>
> Obviously, SOMETHING is trying to login as the user(s) ... By the security
> event logs, it should tell you where, when and by what ...
>
> "djc8484" <djc8484@discussions.microsoft.com> wrote in message
> news:00C98986-3FAD-4F8E-96D9-67C4D0462E79@microsoft.com...
>> Anyone one of you big bad MVPs want to help with this one or is this out
> of
>> your league?
>>
>> "djc8484" wrote:
>>
>> > I am seeing a very strage issue on my network. My user account and
> others
>> > are being locked out multiple times per day. After checking the
> Security
>> > logs on my DC and using the various lockout tools, I notice that dozens
> of
>> > computers in my location make attempts to logon with my user
> credentials.
>> > The same computer doesn't keep trying but lots of them just try once,
>> > eventually locking out my account. I have checked the obvious,
>> > services
>> > using my account, mapped drives and everything else I read in the
> Account
>> > Lockout white paper. Anyone have any ideas on what this could be?
>
>