microsoft authentication package v1.0 locking out user
I have a user running a Mac and his account is getting locked out constantly. He claims that nothing is using old credentials and that he deleted his keypass. however, every couple days we get this in the domain controllers:
Logon attempt by: MICROSOFT_AUTHENTICATION_P
Logon account: <user name>
Source Workstation: \\workstation
Error Code: 0xC000006A
Normally i would look at the source workstation area as it would tell me an IP address or valid computername. however, \\workstation never shows on our DNS or DHCP logs. and the microsoft authentication package v1.0 seems to be very generic from the searching i've done.
ive been using eventcoombt.exe and lockottstatus.exe to try and troubleshoot but i dont know where else to look. can install anything on this users mac or the DC's to get more detail or anything?
Logon attempt by: MICROSOFT_AUTHENTICATION_P
Logon account: <user name>
Source Workstation: \\workstation
Error Code: 0xC000006A
Normally i would look at the source workstation area as it would tell me an IP address or valid computername. however, \\workstation never shows on our DNS or DHCP logs. and the microsoft authentication package v1.0 seems to be very generic from the searching i've done.
ive been using eventcoombt.exe and lockottstatus.exe to try and troubleshoot but i dont know where else to look. can install anything on this users mac or the DC's to get more detail or anything?
ASKER
We checked his devices and they are all changed. Also I've noticed that if its an iPad, or a smart
ASKER
Phone the source workstation would indicate the IP of our exchange server. Which in this case it isn't.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Lots of good links. Thank you. The user told me today that he found manual entries in his fstab file. Even though this is something i mentioned to him earlier.
If that is so, then this would most probably be the culprit, because if the user changes his password on his workstation, he has to do the same on every wireless device connected. Otherwise the wireless devices would persist on attempting to login with the old credentials, hence locking his account constantly.