Account Locks out frequently

Posted on 2008-11-06
Last Modified: 2013-12-07
We have one user and their account keeps getting locked out. We have LockoutStatus.exe running on the DC and it seems that there is a bad password attempt about every 10 minutes. There are no security logs on the user's computer or the DC that coorespond to any of the times that the account has been locked. We have shut his computer off and monitored his account. With the computer off the account still locked, so we have determined that it is another computer on the network. How can I find what computer is causing this issue. I have also tried using EventCombMT and it founf nothing. Anyone have any ideas? The workstations are all running XP and the DC is running Server 2003.
Question by:Synergon
    LVL 3

    Accepted Solution

    Check if Account Audit is enabled on the server. If this is enabled then you should have the logs of Bad logins which should give you an idea about where the attempts are coming from. Looks like it a system service that is trying to logon using the user account.

    Author Comment

    Thank you that did help. I enabled account audit on the DC and was able to find the logs where it was locking the account. I am a little confused about the results. It says that the Logon was attempted by MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    and that the source workstation is our exchange server.

    Here is what the security event says:

    Date: 11/6/2008     Source: Security
    Time: 1:21:09          Category: Account Logon
    Type: Failure Aud    Event ID: 680
    Computer: DC

    Logon attempt by:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
     Logon account:      user's email address
     Source Workstation:      Exchange server
     Error Code:      0xC000006A

    Any further help would be greatly appreciated. Thanks
    LVL 3

    Expert Comment


    Author Comment

    Thank you for your help. We were able to track the problem down to a misconfigured blackberry.

    Featured Post

    Courses: Start Training Online With Pros, Today

    Brush up on the basics or master the advanced techniques required to earn essential industry certifications, with Courses. Enroll in a course and start learning today. Training topics range from Android App Dev to the Xen Virtualization Platform.

    Join & Write a Comment

    Good afternoon all, We are running a VM infrastructure on a clustered ESX environment with two DELL R710's.  One of our IT Application Support Engineers contacted me and asked if it was possible to extend the partition of a certain Windows 2003 S…
    Storage devices are generally used to save the data or sometime transfer the data from one computer system to another system. However, sometimes user accidentally erased their important data from the Storage devices. Users have to know how data reco…
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now