Results 1 to 9 of 9

Thread: Re-occuring Administrator User Account Lockout

  1. #1
    Join Date
    Apr 2004
    Posts
    8

    Re-occuring Administrator User Account Lockout

    I am running windows 2000 on desktop, rest of the things work fine on my system except one strange thing. Am noticing from long time that every week approximately at the same time and day, one of my Administrator gtoup gets locked automatically on this PC. I don’t have any idea how that could happen. When I checked the Sec longs, this is what I found in the same:

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Account Logon
    Event ID: 676
    Date: 9/26/2005
    Time: 12:51:39 PM
    User: NT AUTHORITY\SYSTEM
    Computer: DC1
    Description:
    Authentication Ticket Request Failed:
    User Name: admnstr
    Supplied Realm Name: DOMAINA
    Service Name: krbtgt/DOMAINA
    Ticket Options: 0x40810010
    Failure Code: 0x12
    Client Address: 127.0.0.1
    Any help fixing the same with be appreciated.

  2. #2
    Join Date
    Feb 2006
    Posts
    214

    Re: Re-occuring Administrator User Account Lockout

    Such problem may occur if any user from your Administrator group changes his password on any other system (users have mapped drives from one system to other), then next time when this system tries to attempt to stay mapped it tries the same earlier password and when it gets wrong, it gets locked automatically. In order to see if this is the case you can tryout eventcomboMT.exe or the built-in AccountLockouts search for those users.

  3. #3
    Join Date
    Jul 2004
    Posts
    109

    Re: Re-occuring Administrator User Account Lockout

    According to your last 2 lines of the errors, that is ‘Failure Code: 0x12” and “Client Address: 127.0.0.1”, means that the logon failed because of time-of-day or workstation restrictions. And I don’t think it is happening because of any other user because the IP 127.0.0.1 is the main system itself.

  4. #4
    Join Date
    Mar 2012
    Posts
    5

    Re: Re-occuring Administrator User Account Lockout

    Hello,

    I know this is and (very) old thread, but I was wondering if someone ever found a solution to this problem?

    Thanks in advance.

    CZ

  5. #5
    Join Date
    Aug 2011
    Posts
    410

    Re: Re-occuring Administrator User Account Lockout

    You can try to check the status of LockoutStatus.exe. This service is a part of server which you can find in management tools. It can identify the controller because of which the admin account gets locked. Even if someone tries to login in admin account a number of time with wrong password the account get locks. Check that some is trying to access admin account or not. You can find that in the event log.

  6. #6
    Join Date
    Mar 2012
    Posts
    5

    Re: Re-occuring Administrator User Account Lockout

    Hello Aaryan2011,

    I've been trying to find out with LockoutStatus and EventComb what's causing the problem, but to no avail. There's a number of machines that are causing this, all Windows 7 SP1 x64. All have been created from the same image and reconfigured (renamed and re-imported into the domain) afterwards. The problem started after I changed my domain password.

    Thanks for any advice you can give me towards solving this problem.

    Brgds,

    CZ

  7. #7
    Join Date
    Apr 2012
    Posts
    2

    Re: Re-occuring Administrator User Account Lockout

    I have also started having this issue 2 weeks ago and its driving me insane. It is worth mentioning mine usually starts to happen afternoon, and i have checked the servers that this is happening on. No scheduled tasks and no services run under my domain name.

    Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    Logon account: user
    Source Workstation: server5
    Error Code: 0xC0000234

    Then immediately:

    Pre-authentication failed:
    User Name: user
    User ID: DOMAIN\user
    Service Name: krbtgt/domain
    Pre-Authentication Type: 0x2
    Failure Code: 0x12
    Client Address: 192.168.1.48

  8. #8
    Join Date
    Mar 2012
    Posts
    5

    Re: Re-occuring Administrator User Account Lockout

    Hazma,

    The only way I could stop this, was by checking 'this account does not require pre-authentication' in the account's properties in AD. Haven't had a lockout since.

    Hope this helps.

    Brgds,

    CZ

  9. #9
    Join Date
    Apr 2012
    Posts
    2

    Re: Re-occuring Administrator User Account Lockout

    Thank you, I just made the change, and see how it goes through out the day.

Similar Threads

  1. Replies: 5
    Last Post: 02-07-2011, 08:47 PM
  2. Replies: 3
    Last Post: 21-03-2011, 05:48 PM
  3. What is Account Lockout Policy
    By unlimitedtech in forum Networking & Security
    Replies: 1
    Last Post: 31-07-2009, 10:35 PM
  4. User account type changed to debugger (was Administrator)
    By Dilbert in forum Windows Security
    Replies: 3
    Last Post: 16-07-2008, 03:47 PM
  5. Forgot password for administrator user account
    By Loeb in forum Windows Security
    Replies: 1
    Last Post: 12-02-2008, 06:26 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •