Account Lockout

[thesaint]

Hello,

I have some problems with an account which is locked out every 20
seconds
I checked the account with the Resource Kit tool "lockoutstatus" and
there I got the lockout time and the lockout dc
After that I checked the event viewer of the dc to get the machine
which is responsible for the lockout, but at the event viewer the field
Source Workstation: is empty
The event viewer entrys look like this:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: u0ytf
Source Workstation:
Error Code: 0xC0000234


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

and this

User Account Locked Out:
Target Account Name: u0ytf
Target Account ID: MN-MAN\u0ytf
Caller Machine Name:
Caller User Name: MNDEMUCDC03$
Caller Domain: MN-MAN
Caller Logon ID: (0x0,0x3E7)


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Did anybody ever seen something like this?
If yes, is the there a solution for this or can I get the machine which
locks the user?

Thank you

Bye

 

[Ace Fekay [MVP]]

In

Hello,

I have some problems with an account which is locked out every 20
seconds
I checked the account with the Resource Kit tool "lockoutstatus" and
there I got the lockout time and the lockout dc
After that I checked the event viewer of the dc to get the machine
which is responsible for the lockout, but at the event viewer the
field Source Workstation: is empty
The event viewer entrys look like this:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: u0ytf
Source Workstation:
Error Code: 0xC0000234


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

and this

User Account Locked Out:
Target Account Name: u0ytf
Target Account ID: MN-MAN\u0ytf
Caller Machine Name:
Caller User Name: MNDEMUCDC03$
Caller Domain: MN-MAN
Caller Logon ID: (0x0,0x3E7)


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Did anybody ever seen something like this?
If yes, is the there a solution for this or can I get the machine
which locks the user?

Thank you

Bye

What Event ID is it, 681, 680, 672 or 673?
Does that account exist on your domain (u0ytf)?
Is IIS installed on this machine?

See if this helps.
http://www.monitorware.com/en/events/details.php?details_id=25
http://www.experts-exchange.com/Security/Q_21271896.html

I found them by using Google looking up:
Error Code: 0xC0000234

There are more hits, see if they help:
http://www.google.com/search?hl=en&q=Error+Code:+0xC0000234&btnG=Google+Search


--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

If you are having difficulty in reading or finding responses to your post,
instead of the website you are using, if I may suggest to use OEx (Outlook
Express or any other newsreader of your choosing), and configure a newsgroup
account, pointing to news.microsoft.com. This is a direct link into the
Microsoft Public Newsgroups, and it is FREE and DOES NOT require a Usenet
account with your ISP. With OEx, you can easily find your post, track
threads, cross-post, and sort by date, poster's name, watched threads or
subject.

Not sure how? It's easy:
How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Windows Server Directory Services
Microsoft Certified Trainer
Assimilation Imminent. Resistance is Futile.
Infinite Diversities in Infinite Combinations.
=================================

 

[Paul Bergson]

I haven't seen monitoreware before, I'll have to give it a try.

Thanks

--


Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.


"Ace Fekay [MVP]"

 

[Kevin D. Goodknecht Sr. [MVP]]

Hello,

I have some problems with an account which is locked out every 20
seconds
I checked the account with the Resource Kit tool "lockoutstatus" and
there I got the lockout time and the lockout dc
After that I checked the event viewer of the dc to get the machine
which is responsible for the lockout, but at the event viewer the
field Source Workstation: is empty

The first place to check is Scheduled tasks, where there is likely a task
using an old password. Of course you'll still need to find the source
workstation.

 

[Ace Fekay [MVP]]

In

I haven't seen monitoreware before, I'll have to give it a try.

Thanks

Actually I haven't either, but it looks like a good tool and worth a try.

Ace

 

[ganesamoorthy]

Hi,

Use the below procedure to resolve frequent account lockout

http://www.windowstricks.in/2009/07/account-lockout.html

Cheers,
www.windowstricks.in