Locked account

[James]

I've got a service account used for a software
distribution program. Something somewhere is locking the
account out, but I can't figure what.

I'm trying to use the EventcombMT utility to track down
the problematic PC (or PC's)

I've turned on auditing, which is working cause lots of
events are being picked up but I can't find the ones that
are locking the account, just the thosaunds after saying
the account is locked! Any ideas?

Cheers, James

 

[Simon Geary]

Account lockouts can be very complex to troubleshoot and have numerous
causes so there can be no quick answers to this one. Your best bet is to
work your way through Microsoft's account lockout troubleshooting guide and
see what it throws up.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/bpactlck.mspx

 

[Joe Richards [MVP]]

Well even the ones saying the account is locked are good to look at, it should
give you a machine name from whence the attempts are coming from, do they appear
to be coming from the correct places?

 

[Guest]

well the lockout are coming from all machines... beacuse
the service account is running on all our clients. Once
the account is locked they all throw the problem up!

 

[Joe Richards [MVP]]

AH I see, so yes, assuming you are talking about XP/Wiun2K machines you probably
need to look for the 675 events in your security log. They are kerberos pre-auth
failures.