W2K3 AD Account Lockout

Domain functional level; W2K3
Auditing Enabled
domain admin account !Admin was continually locked out after running
spyware/malware tools on an XP machine w/KB958644 patch installed.
Used lockoutstatus and eventcombt but unable to determine which
machine may be banging on the DC, forcing the lockout, no event id 644
(account locked out) in the logs.
Deleted !Admin and created another account of the same name, which is
also continually locked out. Able to create other accounts w/no
issue.
I installed MS Network Monitor packet capture on the DC showing 25 bad
passwords, but don't know how to filter the output to show failed
logon attempts.
Replmon doesn't show any AD errors.

suggestions?
tia
S

Howdie!

HulloSon schrieb:
> Domain functional level; W2K3
> Auditing Enabled
> domain admin account !Admin was continually locked out after running
> spyware/malware tools on an XP machine w/KB958644 patch installed.
> Used lockoutstatus and eventcombt but unable to determine which
> machine may be banging on the DC, forcing the lockout, no event id 644
> (account locked out) in the logs.
> Deleted !Admin and created another account of the same name, which is
> also continually locked out. Able to create other accounts w/no
> issue.
> I installed MS Network Monitor packet capture on the DC showing 25 bad
> passwords, but don't know how to filter the output to show failed
> logon attempts.
> Replmon doesn't show any AD errors.

Is that only one DC? If not, check all DCs' security event logs to get
an idea of where the lockout occurs. My guess is that one of your
machines is infected with the Conficker malware.

Cheers,
Florian
--
Microsoft MVP - Group Policy
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
Maillist (german): http://frickelsoft.net/cms/index.php?page=mailingliste

Hi
Check
http://www.microsoft.com/downloads/d...displaylang=en
http://www.microsoft.com/downloads/d...displaylang=en

--
I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MVP Directory Services
"HulloSon" <HulloSon@gmail.com> wrote in message
news:b389f754-6a5d-4d22-81f1-71a304ac9345@j12g2000vbl.googlegroups.com...
> Domain functional level; W2K3
> Auditing Enabled
> domain admin account !Admin was continually locked out after running
> spyware/malware tools on an XP machine w/KB958644 patch installed.
> Used lockoutstatus and eventcombt but unable to determine which
> machine may be banging on the DC, forcing the lockout, no event id 644
> (account locked out) in the logs.
> Deleted !Admin and created another account of the same name, which is
> also continually locked out. Able to create other accounts w/no
> issue.
> I installed MS Network Monitor packet capture on the DC showing 25 bad
> passwords, but don't know how to filter the output to show failed
> logon attempts.
> Replmon doesn't show any AD errors.
>
> suggestions?
> tia
> S

Check out an article I have on this, yes it does mention eventcombt so there
is some duplicity

http://www.pbbergs.com/windows/articles.htm
Select User Account Lockout Troubleshooting

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.

"HulloSon" <HulloSon@gmail.com> wrote in message
news:b389f754-6a5d-4d22-81f1-71a304ac9345@j12g2000vbl.googlegroups.com...
> Domain functional level; W2K3
> Auditing Enabled
> domain admin account !Admin was continually locked out after running
> spyware/malware tools on an XP machine w/KB958644 patch installed.
> Used lockoutstatus and eventcombt but unable to determine which
> machine may be banging on the DC, forcing the lockout, no event id 644
> (account locked out) in the logs.
> Deleted !Admin and created another account of the same name, which is
> also continually locked out. Able to create other accounts w/no
> issue.
> I installed MS Network Monitor packet capture on the DC showing 25 bad
> passwords, but don't know how to filter the output to show failed
> logon attempts.
> Replmon doesn't show any AD errors.
>
> suggestions?
> tia
> S