We have a windows 2000 domain server with a number of users defined in active directory.
Recently one user changed her network password on her PC which was fine. But shortly after started getting locked out of her account. Looking at the security event log we are seeing the following events for that account ever 1-3 minutes:
Initially three times...
Event 681:
The logon to account: lucyml
by: MICROSOFT_AUTHENTICATION_P
from workstation: ROSIE-G4-COMPUT
failed. The error code was: 3221225578
Event 529:
Logon Failure:
Reason: Unknown user name or bad password
User Name: lucyml
Domain: xxx
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: ROSIE-G4-COMPUT
And then ...
Event 681:
The logon to account: lucyml
by: MICROSOFT_AUTHENTICATION_P
from workstation: ROSIE-G4-COMPUT
failed. The error code was: 3221226036
and Event 539:
Logon Failure:
Reason: Account locked out
User Name: lucyml
Domain: xxx
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: ROSIE-G4-COMPUT
As you can see the user lucyml is now locked out. The source is an Apple MAC G4 running OS-X. The strange thing is that the main user of the MAC isn't lucyml, they use an account name of rosiecp on that MAC. So there must be some application or network connection on this MAC that is trying to connect to some domain resource using the lucyml account which is not the default login. These two users do work closely together and lucyml does sometimes do work on the G4 but both users insist they have not made any connections or installed any applications with the lucyml account!
My MAC knowledge is very limited, I have looked for any obvious network connections or applications but I am stumped. Our only sollution so far is to un-plug the MAC from the network so that we can unlock the lucyml account on the DC. Any suggestions would be greatly appreciated.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
You can look in the users keychain to see all the saved passwords in use, and the certificates that the computer is using as well. Sometimes when you change your domain password its not always updated in the keychain. You can get to the keychain by: Applications > Utilities > Keychain Access
Hope that helps.
Thanks,
I checked the Keychain as advised but it only contains the details for the main user. No other certificates or anything that suggests lucyml had access from this machine. I spent some time going through all the configuration files in /etc looking for any reference to the lucyml account but still nothing.
I'm completely stumped.
I know you said that you've checked the keychain, so this may be irrelevant. We had a similar issue when users were connecting with Entourage. Entourage would keep trying to connect with the users old password, which was not saved, without error warnings. This would immediately lock out that account without any obvious error.
Entourage hadn't been used, there were no accounts defined in it. The user seems to be using Outlook Express running under MAC OS 9.x in emulation for some reason. Again I checked the accounts but it only has the rosiecp user defined not the lucyml account. I think we may have to do a clean install of OS X to get round this.
Something a little simpler may be to create a new user, login as that user and see if it locks the machine out, then you might just rebuild the user data rather than install all new apps to save you a little time. If it still does it, at least you know it wasn't user-level and can then wipe the OS. Very interesting to say the least.
I tried creating a lucyml account with admin privs on the G4, rebooted and logged in with this account. Still had the problem. I tried creating a third account called test but still the same problem. So it must be some daemon that starts at boot which has got the lucyml credentials from somewhere?
We are now going to do a full clean install.
Thanks for your help.
Business Accounts
Answer for Membership
by: KCTSPosted on 2008-10-28 at 07:22:36ID: 22822087
I suspect that the MAC is trying to connect to a share on the server and is using a stored username/password as credentials to access the share - this will generate a logon failure if the password has been changed and may lock the account if the threshold is exceeded.