Mysterious 681s

[Rob W.]

I'm hoping someone can shed some light on an issue we're having with a
remote user. He has an account in AD and uses a DSL/VPN connection to
authenticate to the network so he can access email through OWA and
applications through our Terminal Server.

There are two issues.
1) He often gets locked out of his account because the network won't
accept his logon. (I recently had him remove and recreate his user
profile on the machine and that seems to have helped but he still has
been locked out once since then.)
2) Then, today when I was checking the event viewer security logs I
noticed he had thirteen 681s with error code 3221225578 from this
morning, ("User logon with misspelled or bad password.") When I told
him about it he was puzzled because he'd logged in on the first try
this morning. Further, he would have only had 3 tries, not 13. The
times that the 681s occurred coincided with when he was logging in so
I don't suspect that anyone was trying to guess his password.

Could these 681s and lockouts be caused by some service running on his
machine?

 

[Shawn Rabourn \(MS\)]

If you are running SP4 or later with certain fixes in place, the behavior is
consistent with a service account or an application.

We have an account lockout troubleshooter to help you out and also setting
netlogon logging will identify the source of where these logons are coming
from.

http://www.microsoft.com/downloads/...90-a13b-4977-a4fc-3e2b67e3748e&DisplayLang=en

109626 Enabling Debug Logging for the Net Logon Service
http://support.microsoft.com/?id=109626

--Shawn
This posting is provided "AS IS" with no warranties and confers no rights.