Account locked out problems

[Phil]

I have about 100 clients which login to a Win2000 sp4 PDC.
The clients are a mix of Win9x, Win2000 and WinXP systems.
A few of our Win98SE systems will occasionally either not
login in the morning or randomly get disconnected from the
server with a status of "Account Locked Out". The error
message on the client is "The domain password you supplied
is not correct, or access to your logon server has been
denied".

The users are entering in the correct password as far as I
can tell each time. I have even confirmed in some cases by
entering in their passwords myself. Resetting the account
status by unchecking "Account Locked Out" doesn't always
work, I often have to restart the client machine, login as
Administrator and log out before the user can login again
with their own password.

This appears to be limited to a few Win98SE clients (maybe
5 out of about 30, most of those 30 have similar if not
exact same hardware), and does not happen all the time,
maybe once or twice a week per problem client.

Searching through the knowledge base hasn't helped me yet,
so any assistance as to what might be causing this would be
greatly appreciated.

 

[Yor Suiris]

My first thought would be that the Local Password stored on the Win9x
machines is not in sync with the network password. I would delete all files
with a PWD extension on the Win9x. Then have the user log off and back on.
When prompted to confirm password enter BLANK (nil, nothing) in both boxes.
Then no passwords will be saved on the Win9x WSs.

 

[Marina Roos]

Is WINS installed on the server? Do you have options 044 and 046 (0x8) in
DHCP-server, Scope Options? How many nics in the server?
Does the RestrictAnonymous value in the serverregistry have a value 0 or 1?
Does the ipconfig/all from the clients (on W9x winipcfg) show that
everything is pointing to the server-IP?

 

[Phil]

Is WINS installed on the server? No
Do you have options 044 and 046 (0x8) in DHCP-server, Scope
Options? No, we don't use WINS on the server.
How many nics in the server? 1
Does the RestrictAnonymous value in the serverregistry have
a value 0 or 1? 0 - should it be 1, and if so why?
Does the ipconfig/all from the clients (on W9x winipcfg)
show that everything is pointing to the server-IP? I'm not
sure what you mean by this. Winipcfg shows the client
address, as well as the Default Gateway and the DNS servers
- one of which is the DC.

 

[Phil]

This is how I setup all of our users, the local windows
passwords should all be blank.

 

[Marina Roos]

Install WINS on the server (w98 still needs that) and add the options in
DHCP-server.
0 or 1 is good. If it would be 2 you would have more problems with W9x, like
not being able to change passwords.
Can you post the winipcfg from a client please?