Good day!
One of my user keeps getting locked out everytime he logs on to our network. We tried resetting his password, disconnecting mapped network drives and resetting the I.E. passwords, cache, forms etc, but to no avail. The user can logon to his computer but can not open any network related applications such as Outlook. His status is locked out in Active Directory, and the only solution is to manually Un-Lock the user's profile/account. And the process keeps on repeating when the user logs back on to the network the next day.
I used the alockout.dll tool from microsoft, and the report goes:
Mon Mar 30 10:21:36 2009, PID: 5056, Thread: 5808, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 10:22:02 2009, PID: 5056, Thread: 5808, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 10:26:32 2009, PID: 4348, Thread: 5552, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 10:38:14 2009, PID: 4348, Thread: 5552, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:00:35 2009, PID: 3408, Thread: 4720, Image C:\Program Files\Trend Micro\OfficeScan Client\TSC.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 11:01:00 2009, PID: 3408, Thread: 4720, Image C:\Program Files\Trend Micro\OfficeScan Client\TSC.EXE,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:03:18 2009, PID: 4316, Thread: 5792, Image C:\Program Files\Altiris\Altiris Agent\Software
Delivery\{0E4BA01B-A8C8-49F2-B96F-FEB2884AA84C}\cache\WindowsXP-KB958690-x86-ENU.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 11:03:21 2009, PID: 3268, Thread: 5496, Image c:\4b1bd03c56b0d05eacebe6c1\update\update.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 11:03:40 2009, PID: 3268, Thread: 5496, Image c:\4b1bd03c56b0d05eacebe6c1\update\update.exe,***StartServiceW Failed!*** (0), Service: Service: HTTP (System32\Drivers\HTTP.sys), RC was: The
operation completed successfully. (0), GLE was: An instance of the service is already running. (1056)
Mon Mar 30 11:03:49 2009, PID: 3268, Thread: 5496, Image c:\4b1bd03c56b0d05eacebe6c1\update\update.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:03:49 2009, PID: 4316, Thread: 5792, Image C:\Program Files\Altiris\Altiris Agent\Software
Delivery\{0E4BA01B-A8C8-49F2-B96F-FEB2884AA84C}\cache\WindowsXP-KB958690-x86-ENU.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:03:54 2009, PID: 5320, Thread: 4620, Image C:\Program Files\Altiris\Altiris Agent\Software
Delivery\{EC1E219C-1614-422A-A15E-98A49334459C}\cache\WindowsXP-KB960225-x86-ENU.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 11:03:56 2009, PID: 4108, Thread: 4940, Image c:\df88a2092896e3016a5afbd78678c43f\update\update.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 11:04:00 2009, PID: 4108, Thread: 4940, Image c:\df88a2092896e3016a5afbd78678c43f\update\update.exe,***StartServiceW Failed!*** (0), Service: Service: HTTP (System32\Drivers\HTTP.sys), RC was:
The operation completed successfully. (0), GLE was: An instance of the service is already running. (1056)
Mon Mar 30 11:04:02 2009, PID: 4108, Thread: 4940, Image c:\df88a2092896e3016a5afbd78678c43f\update\update.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:04:03 2009, PID: 5320, Thread: 4620, Image C:\Program Files\Altiris\Altiris Agent\Software
Delivery\{EC1E219C-1614-422A-A15E-98A49334459C}\cache\WindowsXP-KB960225-x86-ENU.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:22:00 2009, PID: 5960, Thread: 752, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 11:23:25 2009, PID: 5960, Thread: 752, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:45:47 2009, PID: 4568, Thread: 5244, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 11:50:01 2009, PID: 4568, Thread: 5244, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:50:06 2009, PID: 4888, Thread: 4580, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 12:06:33 2009, PID: 4888, Thread: 4580, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 12:14:33 2009, PID: 356, Thread: 4364, Image C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe,***StartServiceW Failed!*** (0), Service: Service: tmcomm
(\??\C:\WINDOWS\system32\drivers\tmcomm.sys), RC was: Incorrect function. (1), GLE was: The operation completed successfully. (0)
Mon Mar 30 12:14:34 2009, PID: 356, Thread: 2288, Image C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe,***StartServiceW Failed!*** (0), Service: Service: Trend Micro VSAPI NT (\??\C:\Program
Files\Trend Micro\OfficeScan Client\VSApiNt.sys), RC was: Incorrect function. (1), GLE was: The operation completed successfully. (0)
Mon Mar 30 12:14:35 2009, PID: 356, Thread: 2288, Image C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe,***StartServiceW Failed!*** (0), Service: Service: Trend Micro Filter (\??\C:\Program
Files\Trend Micro\OfficeScan Client\TmXPFlt.sys), RC was: Incorrect function. (1), GLE was: The operation completed successfully. (0)
Mon Mar 30 12:19:22 2009, PID: 2712, Thread: 1912, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 12:23:42 2009, PID: 2712, Thread: 1912, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 12:24:36 2009, PID: 4768, Thread: 4264, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 12:26:08 2009, PID: 4768, Thread: 4264, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 12:47:34 2009, PID: 4796, Thread: 5332, Image C:\WINDOWS\system32\defrag.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 12:47:34 2009, PID: 5144, Thread: 4920, Image DfrgNtfs.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 12:49:36 2009, PID: 4796, Thread: 5332, Image C:\WINDOWS\system32\defrag.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 12:49:36 2009, PID: 5144, Thread: 4920, Image DfrgNtfs.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 12:50:06 2009, PID: 5028, Thread: 4572, Image C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 12:50:09 2009, PID: 3372, Thread: 5740, Image C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 12:51:23 2009, PID: 5028, Thread: 4572, Image C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 12:51:51 2009, PID: 3372, Thread: 5740, Image C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 13:15:01 2009, PID: 3508, Thread: 1172, Image C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 13:15:18 2009, PID: 2140, Thread: 4604, Image C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 13:15:31 2009, PID: 5548, Thread: 4660, Image aexnsinvcollector.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 13:15:31 2009, PID: 5548, Thread: 4660, Image aexnsinvcollector.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 13:15:34 2009, PID: 676, Thread: 5000, Image aexexchpls.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 13:15:35 2009, PID: 676, Thread: 5000, Image aexexchpls.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 13:16:11 2009, PID: 3212, Thread: 2512, Image aexnsinvcollector.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 13:16:11 2009, PID: 3212, Thread: 2512, Image aexnsinvcollector.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 13:16:52 2009, PID: 2140, Thread: 4604, Image C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 13:17:42 2009, PID: 3508, Thread: 1172, Image C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 15:07:47 2009, PID: 2120, Thread: 4936, Image C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Any idea on what i should look for? Or any other sugegstion onhow to resolve the problem?
One of my user keeps getting locked out everytime he logs on to our network. We tried resetting his password, disconnecting mapped network drives and resetting the I.E. passwords, cache, forms etc, but to no avail. The user can logon to his computer but can not open any network related applications such as Outlook. His status is locked out in Active Directory, and the only solution is to manually Un-Lock the user's profile/account. And the process keeps on repeating when the user logs back on to the network the next day.
I used the alockout.dll tool from microsoft, and the report goes:
Mon Mar 30 10:21:36 2009, PID: 5056, Thread: 5808, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 10:22:02 2009, PID: 5056, Thread: 5808, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 10:26:32 2009, PID: 4348, Thread: 5552, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 10:38:14 2009, PID: 4348, Thread: 5552, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:00:35 2009, PID: 3408, Thread: 4720, Image C:\Program Files\Trend Micro\OfficeScan Client\TSC.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 11:01:00 2009, PID: 3408, Thread: 4720, Image C:\Program Files\Trend Micro\OfficeScan Client\TSC.EXE,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:03:18 2009, PID: 4316, Thread: 5792, Image C:\Program Files\Altiris\Altiris Agent\Software
Delivery\{0E4BA01B-A8C8-49F2-B96F-FEB2884AA84C}\cache\WindowsXP-KB958690-x86-ENU.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 11:03:21 2009, PID: 3268, Thread: 5496, Image c:\4b1bd03c56b0d05eacebe6c1\update\update.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 11:03:40 2009, PID: 3268, Thread: 5496, Image c:\4b1bd03c56b0d05eacebe6c1\update\update.exe,***StartServiceW Failed!*** (0), Service: Service: HTTP (System32\Drivers\HTTP.sys), RC was: The
operation completed successfully. (0), GLE was: An instance of the service is already running. (1056)
Mon Mar 30 11:03:49 2009, PID: 3268, Thread: 5496, Image c:\4b1bd03c56b0d05eacebe6c1\update\update.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:03:49 2009, PID: 4316, Thread: 5792, Image C:\Program Files\Altiris\Altiris Agent\Software
Delivery\{0E4BA01B-A8C8-49F2-B96F-FEB2884AA84C}\cache\WindowsXP-KB958690-x86-ENU.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:03:54 2009, PID: 5320, Thread: 4620, Image C:\Program Files\Altiris\Altiris Agent\Software
Delivery\{EC1E219C-1614-422A-A15E-98A49334459C}\cache\WindowsXP-KB960225-x86-ENU.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 11:03:56 2009, PID: 4108, Thread: 4940, Image c:\df88a2092896e3016a5afbd78678c43f\update\update.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 11:04:00 2009, PID: 4108, Thread: 4940, Image c:\df88a2092896e3016a5afbd78678c43f\update\update.exe,***StartServiceW Failed!*** (0), Service: Service: HTTP (System32\Drivers\HTTP.sys), RC was:
The operation completed successfully. (0), GLE was: An instance of the service is already running. (1056)
Mon Mar 30 11:04:02 2009, PID: 4108, Thread: 4940, Image c:\df88a2092896e3016a5afbd78678c43f\update\update.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:04:03 2009, PID: 5320, Thread: 4620, Image C:\Program Files\Altiris\Altiris Agent\Software
Delivery\{EC1E219C-1614-422A-A15E-98A49334459C}\cache\WindowsXP-KB960225-x86-ENU.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:22:00 2009, PID: 5960, Thread: 752, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 11:23:25 2009, PID: 5960, Thread: 752, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:45:47 2009, PID: 4568, Thread: 5244, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 11:50:01 2009, PID: 4568, Thread: 5244, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 11:50:06 2009, PID: 4888, Thread: 4580, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 12:06:33 2009, PID: 4888, Thread: 4580, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 12:14:33 2009, PID: 356, Thread: 4364, Image C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe,***StartServiceW Failed!*** (0), Service: Service: tmcomm
(\??\C:\WINDOWS\system32\drivers\tmcomm.sys), RC was: Incorrect function. (1), GLE was: The operation completed successfully. (0)
Mon Mar 30 12:14:34 2009, PID: 356, Thread: 2288, Image C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe,***StartServiceW Failed!*** (0), Service: Service: Trend Micro VSAPI NT (\??\C:\Program
Files\Trend Micro\OfficeScan Client\VSApiNt.sys), RC was: Incorrect function. (1), GLE was: The operation completed successfully. (0)
Mon Mar 30 12:14:35 2009, PID: 356, Thread: 2288, Image C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe,***StartServiceW Failed!*** (0), Service: Service: Trend Micro Filter (\??\C:\Program
Files\Trend Micro\OfficeScan Client\TmXPFlt.sys), RC was: Incorrect function. (1), GLE was: The operation completed successfully. (0)
Mon Mar 30 12:19:22 2009, PID: 2712, Thread: 1912, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 12:23:42 2009, PID: 2712, Thread: 1912, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 12:24:36 2009, PID: 4768, Thread: 4264, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 12:26:08 2009, PID: 4768, Thread: 4264, Image C:\Program Files\Internet Explorer\iexplore.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 12:47:34 2009, PID: 4796, Thread: 5332, Image C:\WINDOWS\system32\defrag.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 12:47:34 2009, PID: 5144, Thread: 4920, Image DfrgNtfs.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 12:49:36 2009, PID: 4796, Thread: 5332, Image C:\WINDOWS\system32\defrag.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 12:49:36 2009, PID: 5144, Thread: 4920, Image DfrgNtfs.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 12:50:06 2009, PID: 5028, Thread: 4572, Image C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 12:50:09 2009, PID: 3372, Thread: 5740, Image C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 12:51:23 2009, PID: 5028, Thread: 4572, Image C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 12:51:51 2009, PID: 3372, Thread: 5740, Image C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 13:15:01 2009, PID: 3508, Thread: 1172, Image C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 13:15:18 2009, PID: 2140, Thread: 4604, Image C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 13:15:31 2009, PID: 5548, Thread: 4660, Image aexnsinvcollector.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 13:15:31 2009, PID: 5548, Thread: 4660, Image aexnsinvcollector.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 13:15:34 2009, PID: 676, Thread: 5000, Image aexexchpls.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 13:15:35 2009, PID: 676, Thread: 5000, Image aexexchpls.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 13:16:11 2009, PID: 3212, Thread: 2512, Image aexnsinvcollector.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Mon Mar 30 13:16:11 2009, PID: 3212, Thread: 2512, Image aexnsinvcollector.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 13:16:52 2009, PID: 2140, Thread: 4604, Image C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 13:17:42 2009, PID: 3508, Thread: 1172, Image C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - dll_process_detatch
Mon Mar 30 15:07:47 2009, PID: 2120, Thread: 4936, Image C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Any idea on what i should look for? Or any other sugegstion onhow to resolve the problem?