User account being locked out

Is there a tool that will tell me what is using my username on a server and
causing me to be locked out. I'm getting the event id 675 on my domain
controller that is telling me to look at a specific ip address that is
sending the request.

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 675
Date: 9/17/2008
Time: 5:56:15 PM
User: NT AUTHORITY\SYSTEM
Computer: KNB4
Description:
Pre-authentication failed:
User Name: User
User ID: Domain\User
Service Name: krbtgt/Domain
Pre-Authentication Type: 0x2
Failure Code: 0x12
Client Address: 10.1.x.x


On that server I'm getting an event id 539 account locked out.

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 539
Date: 9/17/2008
Time: 5:34:15 PM
User: NT AUTHORITY\SYSTEM
Computer: VSERVER
Description:
Logon Failure:
Reason: Account locked out
User Name: UserName
Domain: DomainName
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: ServerName
Caller User Name: ServerName$
Caller Domain: Domain
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 3556
Transited Services: -
Source Network Address: -
Source Port: -

I can't find a think on this server that is using my login information.
I've searched the registery for Process ID: 3556 to no avail, searched for my
username to no avail.

Of course I've checked services and scheduled tasks. Any help would be great.

If there's not a tool out there to monitor what on a server is making AD
requests that would be a good one for someone to create and sell.
--
Thanks,

Dale

Hello Dale,

Check out account lockout tools:
http://technet.microsoft.com/en-us/l.../cc738772.aspx

http://www.microsoft.com/downloads/d...displaylang=en

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Is there a tool that will tell me what is using my username on a
> server and causing me to be locked out. I'm getting the event id 675
> on my domain controller that is telling me to look at a specific ip
> address that is sending the request.
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Account Logon
> Event ID: 675
> Date: 9/17/2008
> Time: 5:56:15 PM
> User: NT AUTHORITY\SYSTEM
> Computer: KNB4
> Description:
> Pre-authentication failed:
> User Name: User
> User ID: Domain\User
> Service Name: krbtgt/Domain
> Pre-Authentication Type: 0x2
> Failure Code: 0x12
> Client Address: 10.1.x.x
> On that server I'm getting an event id 539 account locked out.
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 539
> Date: 9/17/2008
> Time: 5:34:15 PM
> User: NT AUTHORITY\SYSTEM
> Computer: VSERVER
> Description:
> Logon Failure:
> Reason: Account locked out
> User Name: UserName
> Domain: DomainName
> Logon Type: 2
> Logon Process: Advapi
> Authentication Package: Negotiate
> Workstation Name: ServerName
> Caller User Name: ServerName$
> Caller Domain: Domain
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 3556
> Transited Services: -
> Source Network Address: -
> Source Port: -
> I can't find a think on this server that is using my login
> information. I've searched the registery for Process ID: 3556 to no
> avail, searched for my username to no avail.
>
> Of course I've checked services and scheduled tasks. Any help would
> be great.
>
> If there's not a tool out there to monitor what on a server is making
> AD requests that would be a good one for someone to create and sell.
>
> Dale
>

Hello

Please run Lockoutstatus.exe from Lockout tools mentioned below. This will
tell you which account is getting locked & request is received by which DC.
Event ID 675 shows "KNB4" as client name. Do you identify this machine name?
When was the last time you reset your account password?
Are you using any of the locked accounts to run Service ? check those &
remove.

cheers !!


"Meinolf Weber" wrote:

> Hello Dale,
>
> Check out account lockout tools:
> http://technet.microsoft.com/en-us/l.../cc738772.aspx
>
> http://www.microsoft.com/downloads/d...displaylang=en
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>
> > Is there a tool that will tell me what is using my username on a
> > server and causing me to be locked out. I'm getting the event id 675
> > on my domain controller that is telling me to look at a specific ip
> > address that is sending the request.
> >
> > Event Type: Failure Audit
> > Event Source: Security
> > Event Category: Account Logon
> > Event ID: 675
> > Date: 9/17/2008
> > Time: 5:56:15 PM
> > User: NT AUTHORITY\SYSTEM
> > Computer: KNB4
> > Description:
> > Pre-authentication failed:
> > User Name: User
> > User ID: Domain\User
> > Service Name: krbtgt/Domain
> > Pre-Authentication Type: 0x2
> > Failure Code: 0x12
> > Client Address: 10.1.x.x
> > On that server I'm getting an event id 539 account locked out.
> >
> > Event Type: Failure Audit
> > Event Source: Security
> > Event Category: Logon/Logoff
> > Event ID: 539
> > Date: 9/17/2008
> > Time: 5:34:15 PM
> > User: NT AUTHORITY\SYSTEM
> > Computer: VSERVER
> > Description:
> > Logon Failure:
> > Reason: Account locked out
> > User Name: UserName
> > Domain: DomainName
> > Logon Type: 2
> > Logon Process: Advapi
> > Authentication Package: Negotiate
> > Workstation Name: ServerName
> > Caller User Name: ServerName$
> > Caller Domain: Domain
> > Caller Logon ID: (0x0,0x3E7)
> > Caller Process ID: 3556
> > Transited Services: -
> > Source Network Address: -
> > Source Port: -
> > I can't find a think on this server that is using my login
> > information. I've searched the registery for Process ID: 3556 to no
> > avail, searched for my username to no avail.
> >
> > Of course I've checked services and scheduled tasks. Any help would
> > be great.
> >
> > If there's not a tool out there to monitor what on a server is making
> > AD requests that would be a good one for someone to create and sell.
> >
> > Dale
> >
>
>
>

I have an article to help you with this.

http://www.pbbergs.com/windows/articles.htm
Select User Account Lockout Troubleshooting

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

"Dale Crowder" <dcrowder@discussions.microsoft.com> wrote in message
news:8EADE770-25D4-4575-831A-63154D1B1177@microsoft.com...
> Is there a tool that will tell me what is using my username on a server
> and
> causing me to be locked out. I'm getting the event id 675 on my domain
> controller that is telling me to look at a specific ip address that is
> sending the request.
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Account Logon
> Event ID: 675
> Date: 9/17/2008
> Time: 5:56:15 PM
> User: NT AUTHORITY\SYSTEM
> Computer: KNB4
> Description:
> Pre-authentication failed:
> User Name: User
> User ID: Domain\User
> Service Name: krbtgt/Domain
> Pre-Authentication Type: 0x2
> Failure Code: 0x12
> Client Address: 10.1.x.x
>
>
> On that server I'm getting an event id 539 account locked out.
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 539
> Date: 9/17/2008
> Time: 5:34:15 PM
> User: NT AUTHORITY\SYSTEM
> Computer: VSERVER
> Description:
> Logon Failure:
> Reason: Account locked out
> User Name: UserName
> Domain: DomainName
> Logon Type: 2
> Logon Process: Advapi
> Authentication Package: Negotiate
> Workstation Name: ServerName
> Caller User Name: ServerName$
> Caller Domain: Domain
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 3556
> Transited Services: -
> Source Network Address: -
> Source Port: -
>
> I can't find a think on this server that is using my login information.
> I've searched the registery for Process ID: 3556 to no avail, searched for
> my
> username to no avail.
>
> Of course I've checked services and scheduled tasks. Any help would be
> great.
>
> If there's not a tool out there to monitor what on a server is making AD
> requests that would be a good one for someone to create and sell.
> --
> Thanks,
>
> Dale

Yes, NetWrix Account Lockout Examiner will troubleshoot all account lockouts and tell you what’s causing them—very helpful.