asked on

Accounts Lockout

We have a clients that has issues with accounts being locked out, Random workstation will show up the DCs security log as locking out all users on the Domain, I installed Account lockout tools and here is what the log says from one of the workstations. They are running SBS 2003 with XP pro workstions. Checked all the cached credentials and they are clear.
Fri Aug 07 12:43:37 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:37 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:37 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141084), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:37 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141085), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141086), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141087), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141088), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:38 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141089), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141090), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141091), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141092), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141093), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:39 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141094), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141095), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141096), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141097), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:40 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141098), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141099), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141100), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141101), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141102), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:41 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141103), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141104), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141105), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141106), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:42 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141107), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141108), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141109), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141110), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:43 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141111), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141112), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141113), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141114), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141115), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:44 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141116), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141117), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141118), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141119), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:45 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141120), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141121), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141122), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141123), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141124), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:46 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:47 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:47 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:47 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141125), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:47 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:47 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:47 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:47 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141126), Local: , Remote: \\RAS36\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Fri Aug 07 12:43:50 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:50 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,* Service Failure - See System Log for Details (ID: 7000) *
Fri Aug 07 12:43:50 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***********************************************************
Fri Aug 07 12:43:50 2009, PID: 1444, Thread: 5804, Image C:\WINDOWS\System32\svchost.exe,***WNetUseConnectionW Failed!*** (141127), Local: , Remote: \\RAS37\IPC$, Password: Password Present, Window Title: , RC was: A specified logon session does not exist. It may already have been terminated. (1312), GLE was: A specified logon session does not exist. It may already have been terminated. (1312)
Thanks,

chuku

do you have any policy that lock accounts after X failed login attempts?

kdog3445

ASKER

Yep, 50 attempts it gets locked out, I can turn it off but dont really want to.

chuku

first for troubleshooting I would turn it off. see if this is the issue
50 attempts is way too many to think that a user was responsible for this just by mistyping. it is more likely a process or service that uses the username and have a wrong password. then when a user start the service it is trying over and over until it get locked

O. Pierru

Hi,

You may also download the Microsoft Account Lockout and Management Tools and see if these can help troubleshoot the problem:

- http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

O. Pierru

And in the ALTools, you may use ALockout.dll (On the client computer, helps determine a process or application that is sending wrong credentials).

kdog3445

ASKER

ALTTools is what i used to create that log, It the lockout errors just from one workstation to another workstion acording the the event log error 644.

kdog3445

ASKER

Oh and another thing i noticed, every workstion a log into that is locking acconts out is not logged in when it happens.

ASKER CERTIFIED SOLUTION

Alan Hardisty

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

O. Pierru

Surely yes, sorry.

"It the lockout errors just from one workstation to another workstion acording the the event log error 644."
Can you reformulate please.

O. Pierru

alanhardisty is probably right if one or more of your systems aren't protected.
++ for Malwarebytes which is a very good antimalware for client computers.

http://blogs.technet.com/rhalbheer/archive/2009/01/13/additional-information-on-conficker-msrt-removing-conficker.aspx

O. Pierru

Keeping Conficker / Downadup malware off your network in 2009
http://www.napera.com/blog/?p=549

kdog3445

ASKER

It was the Conficker Virus, Thanks for you help