Lockouts!

[Brian]

We have a user who keeps getting locked out every 5 min or so. In her
application log there are Event ID: 1000 (Userenv) errors that
correspond to her getting locked out. The error is:

Windows cannot determine the user name or computer name. The return
code is (1326).

I have searched every knowledgebase article I can find on the subject
and nothing. Setting her password to never expire has brought us some
relief but this solution is obviously unacceptable for the long term.
Any ideas, tools etc?

Thanks,
Brian

 

[Jim Singh]

I have seen a similar problem where a user account would keep locking out.
It usually happens if the user mapped a drive and later changed the pass.
and never diconnected it. try disconnecting the mapped drives for some time
for testing and see if it helps.

-Jim

 

[shurley]

There is a free utility available from microsoft bundled with the
"Account Lockout tools". It is called "eventcombMT.exe". There is a
built-in search for account lockouts. This utility will scoure your
security logs and look for account lockouts. It will report back to
you the workstation (or server) that is causing the lockouts. A lock
out, from my experience, is usually caused by a user who changes their
password while still logged in to a computer somewhere else with their
old password. They may also have been logged into a Terminal Server
and "disconnected" without logging off.

Hope this helps.