We have a windows 2000 domain server with a number of users defined in active directory.
Recently one user changed her network password on her PC which was fine. But shortly after started getting locked out of her account. Looking at the security event log we are seeing the following events for that account ever 1-3 minutes:
Initially three times...
Event 681:
The logon to account: lucyml
by: MICROSOFT_AUTHENTICATION_P
ACKAGE_V1_
0
from workstation: ROSIE-G4-COMPUT
failed. The error code was: 3221225578
Event 529:
Logon Failure:
Reason: Unknown user name or bad password
User Name: lucyml
Domain: xxx
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: ROSIE-G4-COMPUT
And then ...
Event 681:
The logon to account: lucyml
by: MICROSOFT_AUTHENTICATION_P
ACKAGE_V1_
0
from workstation: ROSIE-G4-COMPUT
failed. The error code was: 3221226036
and Event 539:
Logon Failure:
Reason: Account locked out
User Name: lucyml
Domain: xxx
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: ROSIE-G4-COMPUT
As you can see the user lucyml is now locked out. The source is an Apple MAC G4 running OS-X. The strange thing is that the main user of the MAC isn't lucyml, they use an account name of rosiecp on that MAC. So there must be some application or network connection on this MAC that is trying to connect to some domain resource using the lucyml account which is not the default login. These two users do work closely together and lucyml does sometimes do work on the G4 but both users insist they have not made any connections or installed any applications with the lucyml account!
My MAC knowledge is very limited, I have looked for any obvious network connections or applications but I am stumped. Our only sollution so far is to un-plug the MAC from the network so that we can unlock the lucyml account on the DC. Any suggestions would be greatly appreciated.
