Failure Audit - Event ID 681??

[Daniel Pratt]

Here's some more details on our situation...

The user logs on to their PC using their own login.
They open Outlook to connect to their exchange account.
They open something called "ReportSmith" (ADP) using a
separate login - not associated with A/D.

They can use their PC for a little while... but after a
little while (the timeframe varies) they become locked
out of the network.

The computer they are authenticating to is throwing the
error. But in the error, where it says "from
workstation:" it lists our email server's name.

As far as services loading with their user account -
nope, none that I can see.

The machine that is generating the lockout is one of our
Domain Controllers. The machine they are logging into to
is their own workstation.

Daniel Pratt
MIS Systems Analyst
Great Blue Heron Charity Casino
Port Perry, Ontario
Canada

 

[Lloyd Newland]

Hi Daniel,

Has the mail server been rebooted recently?

Do the users map any drives to the mail server or is it only used for
Exchange?

Where does ReportSmith reside? If it is on the mail server then if the
users do not open the ReportSmith with the alternate credentials does the
user account lockout?

You may want to look at the Account Lockout whitepaper for some tips on
troubleshooting account lockouts:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechn
ol/windowsserver2003/maintain/operate/BPACTLCK.asp

Please respond directly to the newgroup so all members can learn from your
questions and answers.


Lloyd Newland, MCSE, MCSA

(e-mail address removed)

This posting is provided "AS IS" with no warranties, and confers no rights.