asked on

Account being locked out ever few minutes

We are using WIndows 03 on a domain, with all the users using XP machines. On Friday, one of our users changed her password and now something is causing her account to be locked out on the local DC ever few moments. She's not an outlook user, and other than mapped drives there isn't any other reason we can think of that her PC should be trying to log on to the server so often. Is there a service or something that uses credentials to talk to the server that I don't know about?

Wesley Miller

On her machine from command type:
netsh ras set tracing * enabled
Let her system be until the lock out again occurs then when it does look at the tracing logs found in c:\windows\tracing to see what netwrok activity was occuring during that time when the lock out occurred to find the cuase.
To stop the tracing, from command type: netsh ras set tracing * disabled

wes

dexIT

Have you seen any security audit entries in eventvwr for this user?

adml_shake

ASKER

Here is the output I got from running that for a few moments (it didn't take long to disable the account
There was more, but it basically just repeated this over and over. Thanks for the help.

1692] 11:07:57: Denying dynamic port
Process ID: 756
RPC port: False
Application name:
Process image filename: C:\WINDOWS\system32\lsass.exe
IP Version: IPv4
IP Protocol: UDP
Port number: 1279
Local subnet only: False
[1692] 11:07:57: FwNotifyOnDeny: image = C:\WINDOWS\system32\lsass.exe; proto = UDP; port = 1279
[1692] 11:07:57: FwNotifyOnDeny: Wildcarded UDP port.
[188] 11:07:57: Removing dynamic port
Process ID: 756
RPC port: False
Application name:
Process image filename: C:\WINDOWS\system32\lsass.exe
IP Version: IPv4
IP Protocol: UDP
Port number: 1279
Local subnet only: False
[1688] 11:08:01: Denying dynamic port
Process ID: 756
RPC port: False
Application name:
Process image filename: C:\WINDOWS\system32\lsass.exe
IP Version: IPv4
IP Protocol: UDP
Port number: 1280
Local subnet only: False
[1688] 11:08:01: FwNotifyOnDeny: image = C:\WINDOWS\system32\lsass.exe; proto = UDP; port = 1280
[1688] 11:08:01: FwNotifyOnDeny: Wildcarded UDP port.
[188] 11:08:01: Removing dynamic port
Process ID: 756
RPC port: False
Application name:
Process image filename: C:\WINDOWS\system32\lsass.exe
IP Version: IPv4
IP Protocol: UDP
Port number: 1280
Local subnet only: False
[396] 11:08:02: Denying dynamic port
Process ID: 756
RPC port: False
Application name:
Process image filename: C:\WINDOWS\system32\lsass.exe
IP Version: IPv4
IP Protocol: UDP
Port number: 1281
Local subnet only: False
[396] 11:08:02: FwNotifyOnDeny: image = C:\WINDOWS\system32\lsass.exe; proto = UDP; port = 1281
[396] 11:08:02: FwNotifyOnDeny: Wildcarded UDP port.
[188] 11:08:02: Removing dynamic port
Process ID: 756
RPC port: False
Application name:
Process image filename: C:\WINDOWS\system32\lsass.exe
IP Version: IPv4
IP Protocol: UDP
Port number: 1281
Local subnet only: False
[1692] 11:08:07: Denying dynamic port
Process ID: 756
RPC port: False
Application name:
Process image filename: C:\WINDOWS\system32\lsass.exe
IP Version: IPv4
IP Protocol: UDP
Port number: 1282
Local subnet only: False
[1692] 11:08:07: FwNotifyOnDeny: image = C:\WINDOWS\system32\lsass.exe; proto = UDP; port = 1282
[1692] 11:08:07: FwNotifyOnDeny: Wildcarded UDP port.
[188] 11:08:07: Removing dynamic port
Process ID: 756
RPC port: False
Application name:
Process image filename: C:\WINDOWS\system32\lsass.exe
IP Version: IPv4
IP Protocol: UDP
Port number: 1282
Local subnet only: False
[1688] 11:08:12: Denying dynamic port
Process ID: 756
RPC port: False
Application name:
Process image filename: C:\WINDOWS\system32\lsass.exe
IP Version: IPv4
IP Protocol: UDP
Port number: 1283
Local subnet only: False
[1688] 11:08:12: FwNotifyOnDeny: image = C:\WINDOWS\system32\lsass.exe; proto = UDP; port = 1283
[1688] 11:08:12: FwNotifyOnDeny: Wildcarded UDP port.
[188] 11:08:12: Removing dynamic port
Process ID: 756
RPC port: False
Application name:
Process image filename: C:\WINDOWS\system32\lsass.exe
IP Version: IPv4
IP Protocol: UDP
Port number: 1283
Local subnet only: False
[396] 11:08:17: Denying dynamic port
Process ID: 756
RPC port: False
Application name:
Process image filename: C:\WINDOWS\system32\lsass.exe
IP Version: IPv4
IP Protocol: UDP
Port number: 1284
Local subnet only: False
[396] 11:08:17: FwNotifyOnDeny: image = C:\WINDOWS\system32\lsass.exe; proto = UDP; port = 1284
[396] 11:08:17: FwNotifyOnDeny: Wildcarded UDP port.

adml_shake

ASKER

dexIT:

No, I looked in the security logs and the others but didn't see anything

Wesley Miller

Looks like lsass.exe is not able to obtain a proper handshake with the server.
That file has been known to be a attacked by viruses so I'd scan her system to make sure it is virus free. See: http://www.softwarepatch.com/tips/isass.html
Microsoft's Malicious Software Removal Tool can also be installed to remove it: http://support.microsoft.com/kb/890830/
Wes

ASKER CERTIFIED SOLUTION

Wesley Miller

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial