account locking out
One of my user accounts keeps getting locked out, at 03 and 33 minutes past the hour a bad password attempt is registered with the domain controller meaning that after 3 bad passwords or every 1.5 hours his account gets locked out.
I have checked user's PC but can't find anything set to run every half hour.
Here is the event that gets logged on the Domain Controller after each failed logon attempt is generated:
Log Name: Security
Source: Microsoft-Windows-Security
Date: 11/10/2010 10:03:10 AM
Event ID: 4776
Task Category: Credential Validation
Level: Information
Keywords: Audit Failure
User: N/A
Computer: MyDomainController.mydomai
Description:
The domain controller attempted to validate the credentials for an account.
Authentication Package: MICROSOFT_AUTHENTICATION_P
Logon Account: User that keeps getting locked out
Source Workstation: My ISA server
Error Code: 0xc000006a
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Se
<EventID>4776</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>14336</Task>
<Opcode>0</Opcode>
<Keywords>0x80100000000000
<TimeCreated SystemTime="2010-11-10T10:
<EventRecordID>48935665</E
<Correlation />
<Execution ProcessID="604" ThreadID="10492" />
<Channel>Security</Channel
<Computer>MyDomainController.mydomai
<Security />
</System>
<EventData>
<Data Name="PackageName">MICROSO
<Data Name="TargetUserName">User
<Data Name="Workstation">My ISA Server</Data>
<Data Name="Status">0xc000006a</
</EventData>
</Event>
The "Source Workstation" is the name of my ISA server, which makes me think maybe it is somthing on the user's PC trying to authenticate with the ISA server.
I have checked user's PC but can't find anything set to run every half hour.
Here is the event that gets logged on the Domain Controller after each failed logon attempt is generated:
Log Name: Security
Source: Microsoft-Windows-Security
Date: 11/10/2010 10:03:10 AM
Event ID: 4776
Task Category: Credential Validation
Level: Information
Keywords: Audit Failure
User: N/A
Computer: MyDomainController.mydomai
Description:
The domain controller attempted to validate the credentials for an account.
Authentication Package: MICROSOFT_AUTHENTICATION_P
Logon Account: User that keeps getting locked out
Source Workstation: My ISA server
Error Code: 0xc000006a
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Se
<EventID>4776</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>14336</Task>
<Opcode>0</Opcode>
<Keywords>0x80100000000000
<TimeCreated SystemTime="2010-11-10T10:
<EventRecordID>48935665</E
<Correlation />
<Execution ProcessID="604" ThreadID="10492" />
<Channel>Security</Channel
<Computer>MyDomainController.mydomai
<Security />
</System>
<EventData>
<Data Name="PackageName">MICROSO
<Data Name="TargetUserName">User
<Data Name="Workstation">My ISA Server</Data>
<Data Name="Status">0xc000006a</
</EventData>
</Event>
The "Source Workstation" is the name of my ISA server, which makes me think maybe it is somthing on the user's PC trying to authenticate with the ISA server.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Thanks
Glad youre fixed.....
ASKER
I have awarded some points as all your answers seemed helpful in troubleshooting account lockout. Thanks.