NT User A/C Lock

It's found that some users account locked suddenly.
The a/c lock is not caused by user fail to attempt password.
The a/c locked suddenly during user normal operation...
user is successfully logon into the workstation already.

1) It's under NT domain environment
2) the problem happen after users have changed their password

Can anyone help?
thanks
eo

Phillip
Mon Aug 08 11:01:39 CDT 2005

There is something running on thier machines that is continuing to use the
old credentials.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/techinfo/Guidance/2004.asp
http://www.microsoft.com/isaserver/techinfo/Guidance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
-----------------------------------------------------


"eo" <eo@eo.com> wrote in message
news:eeSo8FCnFHA.2180@TK2MSFTNGP15.phx.gbl...
> It's found that some users account locked suddenly.
> The a/c lock is not caused by user fail to attempt password.
> The a/c locked suddenly during user normal operation...
> user is successfully logon into the workstation already.
>
> 1) It's under NT domain environment
> 2) the problem happen after users have changed their password
>
> Can anyone help?
> thanks
> eo
>
>

Dan
Mon Aug 08 15:43:02 CDT 2005

It is possible that these users are logged onto another machine somewhere and
not logged out yet. Therefore, when they renew/reset their passwords, their
logon credentials with the old passwords are still active on the other
machines.

"eo" wrote:

> It's found that some users account locked suddenly.
> The a/c lock is not caused by user fail to attempt password.
> The a/c locked suddenly during user normal operation...
> user is successfully logon into the workstation already.
>
> 1) It's under NT domain environment
> 2) the problem happen after users have changed their password
>
> Can anyone help?
> thanks
> eo
>
>
>

Steven
Wed Aug 10 19:30:33 CDT 2005

That can be caused by several things such as the use of persistent user
credentials in network shares, XP stored credentials. Scheduled Tasks, an
application, a service account, or being logged onto another computer. What
can help is to enable auditing of "logon events" on domain computers and
account management for the domain controllers. The security logs of domain
controllers will show account lockout events and the domain computers will
record a logon failure due to an account lockout. Correlating these events
can help you find the computers involved in the account lockout. You can use
Event Comb to search your computers and domain controllers for specific
Event ID's. The links below should also help. --- Steve

http://www.microsoft.com/downloads/details.aspx?FamilyID=8c8e0d90-a13b-4977-a4fc-3e2b67e3748e&displaylang=en
http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

"eo" <eo@eo.com> wrote in message
news:eeSo8FCnFHA.2180@TK2MSFTNGP15.phx.gbl...
> It's found that some users account locked suddenly.
> The a/c lock is not caused by user fail to attempt password.
> The a/c locked suddenly during user normal operation...
> user is successfully logon into the workstation already.
>
> 1) It's under NT domain environment
> 2) the problem happen after users have changed their password
>
> Can anyone help?
> thanks
> eo
>
>