Administrator account locking out

From the last couple of months I am having some issues with the administrator account that I have, it would simply lock out and this has started to happen when we changed the password prior to that period. But I was able to understand the cause that was some kind of service that had the password saved. Although, the admin account that I am using locks out very quickly as it is unlocked. I have enable the failure auditing and it is giving me some security log that I have listed below:

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 10/3/2006
Time: 6:17:42 AM
User: NT AUTHORITY\SYSTEM
Computer: EMJDC
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Administrator
Source Workstation: workstation
Error Code: 0xC0000234

----------------------------------------------------------------------------------------------------------------------

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 673
Date: 10/3/2006
Time: 6:17:42 AM
User: NT AUTHORITY\SYSTEM
Computer: EMJDC
Description:
Service Ticket Request:
User Name: administrator@DOMAIN.COM
User Domain: DOMAIN.COM
Service Name: krbtgt/DOMAIN.COM
Service ID: -
Ticket Options: 0x2
Ticket Encryption Type: -
Client Address: 127.0.0.1
Failure Code: 0x12
Logon GUID: -
Transited Services: -

Any ideas?

If you want to sort out the admin account temporarily then you should try to rename it first of all. But you should remember that any scheduled tasks or services configured at that account will not work for as you may have done. You can also download some set of tools from the microsoft website which will be able to diagnose the locked out accounts.

Actually, the account name Administrator is unique per machine apart from the domain controllers where it will remain the same on all of them. Incase you have used the Administrator\domain account on machines other than domain controllers then you should know that it is not the Administrators account defined on all of those machines. So, if you rename them then you will really need to look at one machine,at the domain controllers and then you will be able to see the changes made. You can even try to go to microsoft website in the download section and search on account lockout as there is a package of tools that can help you track down the origin of the authentication attempts that are locking the account.

Try to follow the below method and see if that can help:

1. First of all restart the computer that you have and go into Repair Mode, for that use your Windows Repair CD. After that you can try to use System Restore to set the Windows back to a point before any problems that you face.
2. Now you have to plan ahead by having a single administrator account that will involde some risks. Then you will have 2 fully tested admin accounts, with their details recorder on paper or not?