Solved

How to unlock an Account locking out immediately after I unlock it!!

Posted on 2009-04-01
7
325 Views
Last Modified: 2012-05-06
I have a user that it appears put the wrong password in. She said she didn't. However, it keeps saying account is locked out. I go into the server and uncheck the lockout button, hit apply and ok. Then if I immediatly go back into the profile it is locked out again whether I tried to login as her or not.
0
Comment
Question by:aando
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
7 Comments
 
LVL 21

Assisted Solution

by:suppsaws
suppsaws earned 50 total points
ID: 24038859
Hello aando,

did you check the server security logs?

Regards,

suppsaws
0
 
LVL 70

Assisted Solution

by:KCTS
KCTS earned 100 total points
ID: 24038896
It sounds like some service or schedule task is set to use the old credentials - check.
0
 

Author Comment

by:aando
ID: 24039273
1. I cleared the security log and then immediately hit refresh. Two seperate accounts had already tried to login and fail over 100 times.

2. How do I check for services that may be using a old password?

3. Also, another strange thing is that the two accounts that keep doing this are logging onto two Vostro machines that we just formatted and reinstalled. They had Vista, we formatted and put XP Pro on them.
0
MIM Survival Guide for Service Desk Managers

Major incidents can send mastered service desk processes into disorder. Systems and tools produce the data needed to resolve these incidents, but your challenge is getting that information to the right people fast. Check out the Survival Guide and begin bringing order to chaos.

 
LVL 70

Expert Comment

by:KCTS
ID: 24039287
use this script - I can't remember where I got if from - but it works

strComputer = ""
Set objWMIService = GetObject  ("winmgmts:\\" & strComputer & "\root\cimv2")
Set colServices = objWMIService.ExecQuery ("Select * From Win32_Service")

For Each objService in colServices
    Wscript.Echo objService.Name, objService.StartName
Next
0
 

Author Comment

by:aando
ID: 24039312
This is what I am getting every millisecond.

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Account Logon
Event ID:      675
Date:            4/1/2009
Time:            8:55:04 AM
User:            NT AUTHORITY\SYSTEM
Computer:      SBS2K3
Description:
Pre-authentication failed:
       User Name:      kouimet
       User ID:            MAS\kouimet
       Service Name:      krbtgt/MAS.LOCAL
       Pre-Authentication Type:      0x2
       Failure Code:      0x12
       Client Address:      192.168.26.12


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
 

Author Comment

by:aando
ID: 24039336
When I run the script I get an error. I am sure I am doing something wrong. Do I have to change that script in anyway?
0
 

Accepted Solution

by:
aando earned 0 total points
ID: 24039927
http://www.experts-exchange.com/Security/Win_Security/Q_20418480.html#a7549099

This post tells how to fix it. I followed it and the errors stopped.....
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction At 19:33 (UST) on Tuesday 21st September the long awaited email arrived with the subject title of “ANNOUNCING THE AVAILABILITY OF WINDOWS SBS 7 PREVIEW”.  It was time to drop whatever I was doing and dedicate as much bandwidth as possi…
I’m often asked about newer and larger USB drives connected to SBS2008 and 2011 failing Windows Server Backup vs the older USB drives not failing. As disk space continues to grow and drive technology change SBS2008 and some SBS2011 end up with the f…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question