I'm running Win2k servers in mixed mode. I'm running Windows XP on half our desktops, Windows ME (by necessity) on the other half of our desktops and we have one Novell 4.11 server that every connects to for connectivity to an old legacy app.
The problem I am having is with the Windows ME boxes. Randomly, for no specific reason when people try and access network drives, or even sometimes when they're just minding their own business, their 2k accounts get locked out. I have to unlock their accounts, make them reboot, and then everything works fine. This happens at least 5 times a day to random people in an office of 20 Windows ME users.
What the hell is going on!?!
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Hello,
-This article does not specifically mention Windows Me but I believe applies just the same..
-Install the direcory services client & make sure the Me computers are using NTLM2 authentication. Delete any .pwl files as well...
http://support.microsoft.c
1) Even logs are running, what should I be looking for?
2) I can assure no one is running cracking programs on the network.
3) Auditing has been turned on, I can't make heads or tails of anything it's auditing.
4) All NIC's have been updated.
Housenet:
Does running the DS client eliminate ME creating PWL's??
HEllo,
"Does running the DS client eliminate ME creating PWL's??"
-NO.. The point of doing that is to try and make sure that any local cached passwords are actually syncronized credentials for the domain. It is another common reason for account lockout.
"1) Even logs are running, what should I be looking for?"
-You should have failed login attempts being logged to security events.
-What you would be looking for is
1. The station name,or username of the locked out user.
2. The login type (1 through 5)..This is important because it identifies the process that is failing.. (Is it failing when they enter credentials, or when network resources are accessed).
-Specific Event Id numbers & error decriptions make for good search criteria using the M$ knowledge base. support.microsoft.com/supp
Ok, I have some results from the auditing. I am seeing a common theme here with the few users that are getting locked out. Here's what the event looks like and it's an event ID 681, if that means anything:
The logon to account: USERNAME
by: MICROSOFT_AUTHENTICATION_P
from workstation: \\USERNAME
failed. The error code was: 3221226036
What do ya think?
The first event that started was that 681... then came event ID 539:
Logon Failure:
Reason: Account locked out
User Name: JBARLOW
Domain:
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: \\JBARLOW
--------------------------
JBARLOW was the one I listed above, I just changed it to "USERNAME", I'll leave em as is from now on.
Anyways, then came another 681, then another 539, and so on and so forth until it reached the 5 attempts set in my GPO that locks the account out. Interesting thing is that it appears that the account was locked out before it even tried to authenticate those 5 times. Does that make sense?
Did anyone ever successfully fixed this problem?? We are having the same problem here with W98 clients on w2k servers. Several users keep getting locked out for no reason. The same event ID's keep appearing: #539 > account locked when trying to login and #681 > unable to login into locked out account.
Business Accounts
Answer for Membership
by: SysExpertPosted on 2002-11-27 at 10:31:13ID: 7504957
1) Check the event logs on teh servers.
2) Check that no one is trying to run a cracking program on your network.
3) Turn on the auditing for logins.
4) Update all the NIC drivers and make sure that the encryption for logins is set correctly.
I hope this helps !