Event ID 1083 & 1955 and account locks

[jmp13]

Experiencing user accounts getting locked out for no reason. The default
domain policy has no restrictions. Trying to troubleshoot the problem so it
was turned off. It used to be set to 3 for the account lockout policy for bad
login attempts. In the middle of a domain migration from NT4 to 2003 with
Exchange 5.5 to 2003 migration. This issue just started a few weeks ago. My
question is could the the 1083 event ids in the DS log be related to the
account lockout issue. Any other suggestions in trying to find out why
accounts lockout?

[Hayman Ezzeldin]

Dear Jmp13,
These usernames that get locked out are assigned to users or services?

"jmp13" <jmp13@discussions.microsoft.com> wrote in message
news:560D21DB-CE25-43A8-8AC9-593236D9C1FE@microsoft.com...
> Experiencing user accounts getting locked out for no reason. The default
> domain policy has no restrictions. Trying to troubleshoot the problem so
> it
> was turned off. It used to be set to 3 for the account lockout policy for
> bad
> login attempts. In the middle of a domain migration from NT4 to 2003 with
> Exchange 5.5 to 2003 migration. This issue just started a few weeks ago.
> My
> question is could the the 1083 event ids in the DS log be related to the
> account lockout issue. Any other suggestions in trying to find out why
> accounts lockout?

[Hayman Ezzeldin]

Dear Jmp13
Another few things to try
1- Firstly, ensure that the DNS zone for your domain allows Dynamic Updates
(secure only) and make it AD-Integrated if it isn't already.
2- You should also ensure that your GC is online and operating and that all
clients are pointing to right DCs for DNS (in their TCP/ IP settings).
3- After doing this install "Support Tools" from the Windows 2003 CD.
4- Run REPLMON, check replication and force replication.
5- If replication is successful, run DCDIAG /V /C and NETDIAG /V and look to
see if there are any errors and/ or failures

Best regards

"jmp13" <jmp13@discussions.microsoft.com> wrote in message
news:560D21DB-CE25-43A8-8AC9-593236D9C1FE@microsoft.com...
> Experiencing user accounts getting locked out for no reason. The default
> domain policy has no restrictions. Trying to troubleshoot the problem so
> it
> was turned off. It used to be set to 3 for the account lockout policy for
> bad
> login attempts. In the middle of a domain migration from NT4 to 2003 with
> Exchange 5.5 to 2003 migration. This issue just started a few weeks ago.
> My
> question is could the the 1083 event ids in the DS log be related to the
> account lockout issue. Any other suggestions in trying to find out why
> accounts lockout?

[jmp13]

Did most of that - everything is fine. DNS is pointing to the NT world. I
will go test that out.

These are user accounts that have been migrated from NT.

"Hayman Ezzeldin" wrote:

> Dear Jmp13
> Another few things to try
> 1- Firstly, ensure that the DNS zone for your domain allows Dynamic Updates
> (secure only) and make it AD-Integrated if it isn't already.
> 2- You should also ensure that your GC is online and operating and that all
> clients are pointing to right DCs for DNS (in their TCP/ IP settings).
> 3- After doing this install "Support Tools" from the Windows 2003 CD.
> 4- Run REPLMON, check replication and force replication.
> 5- If replication is successful, run DCDIAG /V /C and NETDIAG /V and look to
> see if there are any errors and/ or failures
>
> Best regards
>
> "jmp13" <jmp13@discussions.microsoft.com> wrote in message
> news:560D21DB-CE25-43A8-8AC9-593236D9C1FE@microsoft.com...
> > Experiencing user accounts getting locked out for no reason. The default
> > domain policy has no restrictions. Trying to troubleshoot the problem so
> > it
> > was turned off. It used to be set to 3 for the account lockout policy for
> > bad
> > login attempts. In the middle of a domain migration from NT4 to 2003 with
> > Exchange 5.5 to 2003 migration. This issue just started a few weeks ago.
> > My
> > question is could the the 1083 event ids in the DS log be related to the
> > account lockout issue. Any other suggestions in trying to find out why
> > accounts lockout?
>
>
>

[jmp13]

Changing the clients DNS did not work. Any other suggestions? It is only
happening to a few of the accounts that have been migrated.

"jmp13" wrote:

> Did most of that - everything is fine. DNS is pointing to the NT world. I
> will go test that out.
>
> These are user accounts that have been migrated from NT.
>
> "Hayman Ezzeldin" wrote:
>
> > Dear Jmp13
> > Another few things to try
> > 1- Firstly, ensure that the DNS zone for your domain allows Dynamic Updates
> > (secure only) and make it AD-Integrated if it isn't already.
> > 2- You should also ensure that your GC is online and operating and that all
> > clients are pointing to right DCs for DNS (in their TCP/ IP settings).
> > 3- After doing this install "Support Tools" from the Windows 2003 CD.
> > 4- Run REPLMON, check replication and force replication.
> > 5- If replication is successful, run DCDIAG /V /C and NETDIAG /V and look to
> > see if there are any errors and/ or failures
> >
> > Best regards
> >
> > "jmp13" <jmp13@discussions.microsoft.com> wrote in message
> > news:560D21DB-CE25-43A8-8AC9-593236D9C1FE@microsoft.com...
> > > Experiencing user accounts getting locked out for no reason. The default
> > > domain policy has no restrictions. Trying to troubleshoot the problem so
> > > it
> > > was turned off. It used to be set to 3 for the account lockout policy for
> > > bad
> > > login attempts. In the middle of a domain migration from NT4 to 2003 with
> > > Exchange 5.5 to 2003 migration. This issue just started a few weeks ago.
> > > My
> > > question is could the the 1083 event ids in the DS log be related to the
> > > account lockout issue. Any other suggestions in trying to find out why
> > > accounts lockout?
> >
> >
> >

[Harj]

On Apr 16, 9:42 am, jmp13 <j...@discussions.microsoft.com> wrote:
> Changing the clients DNS did not work. Any other suggestions? It is only
> happening to a few of the accounts that have been migrated.
>
>
>
> "jmp13" wrote:
> > Did most of that - everything is fine. DNS is pointing to the NT world. I
> > will go test that out.
>
> > These are user accounts that have been migrated from NT.
>
> > "Hayman Ezzeldin" wrote:
>
> > > Dear Jmp13
> > > Another few things to try
> > > 1- Firstly, ensure that the DNS zone for your domain allows Dynamic Updates
> > > (secure only) and make it AD-Integrated if it isn't already.
> > > 2- You should also ensure that your GC is online and operating and that all
> > > clients are pointing to right DCs for DNS (in their TCP/ IP settings).
> > > 3- After doing this install "Support Tools" from the Windows 2003 CD.
> > > 4- Run REPLMON, check replication and force replication.
> > > 5- If replication is successful, run DCDIAG /V /C and NETDIAG /V and look to
> > > see if there are any errors and/ or failures
>
> > > Best regards
>
> > > "jmp13" <j...@discussions.microsoft.com> wrote in message
> > >news:560D21DB-CE25-43A8-8AC9-593236D9C1FE@microsoft.com...
> > > > Experiencing user accounts getting locked out for no reason. The default
> > > > domain policy has no restrictions. Trying to troubleshoot the problem so
> > > > it
> > > > was turned off. It used to be set to 3 for the account lockout policy for
> > > > bad
> > > > login attempts. In the middle of a domain migration from NT4 to 2003 with
> > > > Exchange 5.5 to 2003 migration. This issue just started a few weeks ago.
> > > > My
> > > > question is could the the 1083 event ids in the DS log be related to the
> > > > account lockout issue. Any other suggestions in trying to find out why
> > > > accounts lockout?- Hide quoted text -
>
> - Show quoted text -


Hi,

>> It used to be set to 3 for the account lockout policy for bad
login attempts.

Was/is the registry tattooed? When this setting was set, did you just
disable it or set it to not configured or did you change the value
from 3 to 0?
What you can do is set the value to 0 and see if this still causes
accounts to lockout.
If this does not resolve it you can utilize the following tools to
find the root.

A few reasons accounts get locked out:

1.Applications using cached credentials that are stale.
2.Stale service account passwords cached by the Service Control
Manager.
3.Stale logon credentials cached by Stored User Names and Passwords in
Control Panel.
4.Scheduled tasks and persistent drive mappings that have stale
credentials.
5.Disconnected Terminal Service sessions that use stale credentials.
6.Failure of Active Directory replication between domain controllers.
7.Users logging into two or more computers at once and changing their
password on one of them.

Any one of the above situations can trigger an account lockout
condition

Account Lockout and Management Tools
http://www.microsoft.com/downloads/d...displaylang=en

Good luck

Harj Singh
Power Your Active Directory Investment
www.specopssoft.com