asked on
what can cause long delay when logon on windows XP with wrong username - even if not login to a domain?
We experiment very long delay when a misstyped username is entered for opening a session on windows XP (login in to a domain).... But, the same problem occur even if we logon locallly...
Not sure but if we also diconnect the network cable, the delay seem to be normal but as XP change this delay in a normal fashion to avoid hacker trying too many login/password, it's hard to be absolutelly sure about this "Normal delay" because sometimes, even with the cable unplugged, it's long.
We have enable the "UserEnvDebugLevel" registry to track this, but nothing, maybe because it's only involve when a session is opening (after valid username/pass)...
Nothing from the ventviewer too!!!
It can take about 10 minutes !
Thank's
Not sure but if we also diconnect the network cable, the delay seem to be normal but as XP change this delay in a normal fashion to avoid hacker trying too many login/password, it's hard to be absolutelly sure about this "Normal delay" because sometimes, even with the cable unplugged, it's long.
We have enable the "UserEnvDebugLevel" registry to track this, but nothing, maybe because it's only involve when a session is opening (after valid username/pass)...
Nothing from the ventviewer too!!!
It can take about 10 minutes !
Thank's
OS SecurityWindows XPActive Directory
Last Comment
cdsj_info
ASKER CERTIFIED SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
I have seen this with malwares/spyware especially the ones that connect themselves to other websites. So clean up your pc using your spyware/AV and see. you may want to repair the OS as some spyware damage the system.
here is a Good anti- spyware
http://www.gt500.org/malwa
here is a Good anti- spyware
http://www.gt500.org/malwa
Are you seeing this on multiple installations or just one?
ASKER
Thank's for your comment... it help us in the fact that we never look at the netbios name resolution for this problem. So we fund that our DCs was not client of our WINS servers, so that the NetBios records of thoses DCs was not listed and for somes reasons it cause delay. If we try login with awrong UserPrincipalName like wronguser@domain.com (aka. Kerberos login) we got an answer immediately. So it's realy point on NetBios.
We have noe made the DCs client of our WINS servers and we gor decent delay, max 15 seconds. The best should be to force users to use the UPN but even if it's possible to hide the domain name box with a GPO, the users should always provide the full UPN suffix...not really interesting.
Maybe we will find the way to do that...
Anyway, thank's you for your big clue!
We have noe made the DCs client of our WINS servers and we gor decent delay, max 15 seconds. The best should be to force users to use the UPN but even if it's possible to hide the domain name box with a GPO, the users should always provide the full UPN suffix...not really interesting.
Maybe we will find the way to do that...
Anyway, thank's you for your big clue!
for next step see the pic. It is self explanatory.
And if you try on domain with wrong password it depends upon the server account lockdown settings that for how long it will lock the account
gropupolicy.png