Win 2000 Dial up account lockouts out intermittently

Windows 2000  Domain account  will lock out at various times during the day, everyday.   It is a Dial up account with domain user access.  account settings are correct.  She is not logged on to any other machine, and she is the only user at this site.  we have run virus scanner with nothing found. we cannot find anything in the event viewer other than she logged on successfuly. She has no mapped drives. user states that the computer will boot her out and then the account will lock her out.  she is the only one at this site and she has not given her un or pw to anyone.  she does not have a pc at home that she tries to dail in with.  When the user leaves at the end of the day she disconnects from the domain and the next morning her account is locked out.
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

moduloConnect With a Mentor Commented:
Closed, 500 points refunded.

Community Support Moderator
Experts Exchange
Have you enabled failure auditing of logon events at the server? Just in case there is some service trying to run under her credentials with an outdated password...

Deb :))
SecuritasAuthor Commented:
We feel confident the problem has been resolved now. The user in question was a remote user who was connecting through a dial-up account, then using VPN client software to make a tunnel to our OC. When the pc in question was setup it was joined to our domain, the user had been logging into the pc using the cached domain account. At this point the problem came to be when either:

A- The users p/w had expired and was changed.


B- The user forgets p/w and has helpdesk reset it for them.

What we beleive was happening is that once they log on with the cached account, then make there connection and tunnel, that cached account is trying to authenticate to something on the domain, that p/w is different then there current p/w and locking out the account. Fortunately the user new there original password and we changed there account to that. The users account has not locked out in several days.

As a side note we did have failure auditing of logon events turned on but for some reason could find any for the account in question. Thank you Debsyl99.

I will work with the rest of our team to figure out a better solution for our remote users so this can be avoided in the future. Maybe we will have them just logon with a local account.

I was not the original tech to work on the issue so I have stated all the facts to the best of my knowledge and hope this can help someone out in the future.

Ron Z
That's great - Suggest you post a question in Community Support, including a link to this one and request PAQ and refund,
All the best,
Deb :))
All Courses

From novice to tech pro — start learning today.