Re-occuring Administrator User Account Lockout

I am running windows 2000 on desktop, rest of the things work fine on my system except one strange thing. Am noticing from long time that every week approximately at the same time and day, one of my Administrator gtoup gets locked automatically on this PC. I don’t have any idea how that could happen. When I checked the Sec longs, this is what I found in the same:

Quote:

---

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 676
Date: 9/26/2005
Time: 12:51:39 PM
User: NT AUTHORITY\SYSTEM
Computer: DC1
Description:
Authentication Ticket Request Failed:
User Name: admnstr
Supplied Realm Name: DOMAINA
Service Name: krbtgt/DOMAINA
Ticket Options: 0x40810010
Failure Code: 0x12
Client Address: 127.0.0.1

---

Any help fixing the same with be appreciated.

Such problem may occur if any user from your Administrator group changes his password on any other system (users have mapped drives from one system to other), then next time when this system tries to attempt to stay mapped it tries the same earlier password and when it gets wrong, it gets locked automatically. In order to see if this is the case you can tryout eventcomboMT.exe or the built-in AccountLockouts search for those users.

According to your last 2 lines of the errors, that is ‘Failure Code: 0x12” and “Client Address: 127.0.0.1”, means that the logon failed because of time-of-day or workstation restrictions. And I don’t think it is happening because of any other user because the IP 127.0.0.1 is the main system itself.

Hello,

I know this is and (very) old thread, but I was wondering if someone ever found a solution to this problem?

Thanks in advance.

CZ

You can try to check the status of LockoutStatus.exe. This service is a part of server which you can find in management tools. It can identify the controller because of which the admin account gets locked. Even if someone tries to login in admin account a number of time with wrong password the account get locks. Check that some is trying to access admin account or not. You can find that in the event log.

Hello Aaryan2011,

I've been trying to find out with LockoutStatus and EventComb what's causing the problem, but to no avail. There's a number of machines that are causing this, all Windows 7 SP1 x64. All have been created from the same image and reconfigured (renamed and re-imported into the domain) afterwards. The problem started after I changed my domain password.

Thanks for any advice you can give me towards solving this problem.

Brgds,

CZ

I have also started having this issue 2 weeks ago and its driving me insane. It is worth mentioning mine usually starts to happen afternoon, and i have checked the servers that this is happening on. No scheduled tasks and no services run under my domain name.

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user
Source Workstation: server5
Error Code: 0xC0000234

Then immediately:

Pre-authentication failed:
User Name: user
User ID: DOMAIN\user
Service Name: krbtgt/domain
Pre-Authentication Type: 0x2
Failure Code: 0x12
Client Address: 192.168.1.48

Hazma,

The only way I could stop this, was by checking 'this account does not require pre-authentication' in the account's properties in AD. Haven't had a lockout since.

Hope this helps.

Brgds,

CZ

Thank you, I just made the change, and see how it goes through out the day.