Announcement

Collapse
No announcement yet.

AD Account Locking

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • AD Account Locking

    1 AD account is getting locked everyday. EventID 681 is logged in Security log, in whcih workstation name from where logon was attempted is DODOPC-3K8Y86TO, which is not a valid computer name in our AD.

    Any clue !!!!!!!!

  • #2
    Have you viewed the TechNet articles at the following link?
    http://search.microsoft.com/search/r...p;c=10&s=0
    1 1 was a racehorse.
    2 2 was 1 2.
    1 1 1 1 race 1 day,
    2 2 1 1 2

    Comment


    • #3
      I am getting EventID 681 with error code: 3221225578. Sometime locking is done by PDC emulator not by the DC where the user should get authenticated.

      Comment


      • #4
        Is any one on earth got any clue about my AD account locking problem !!!!!!!!!!!!!!

        Comment


        • #5
          Originally posted by biggles77
          Have you viewed the TechNet articles at the following link?
          http://search.microsoft.com/search/r...p;c=10&s=0
          I still don't know if you look at the above links?
          1 1 was a racehorse.
          2 2 was 1 2.
          1 1 1 1 race 1 day,
          2 2 1 1 2

          Comment


          • #6
            Help

            I have seen all Technet article, but of no use.

            Can someone on earth known whats happening with the accounts !!!!!

            Comment


            • #7
              Re: AD Account Locking

              Originally posted by Satwinder Singh
              in whcih workstation name from where logon was attempted is DODOPC-3K8Y86TO, which is not a valid computer name in our AD.

              Any clue !!!!!!!!
              Have you tried adding this computer to your active directory, sounds like the AD is seeing this as the computer, but as it's not a valid computer in your List, it's denying permission, and probably seeing a security breach, and locking the account it's trying to log in under....

              (this is a complete stab int he dark, but it might offer some sanity at the end of the day)...

              B.

              Comment


              • #8
                Sorry it cannot be applied

                Sorry friend, this workstation name keep changing everyday. workstation from where user logon is a valid computer and visible in AD also. Usually this attempted logon are during early morning or late night time

                Comment


                • #9
                  maybe there is a service or scheduled job trying to run from this comptuer with wrong credentials...

                  check it out...
                  Yaniv Feldman
                  Microsoft Security Regional Director
                  Microsoft Management Expert
                  MCSA, MCSE, MCT

                  Comment


                  • #10
                    Originally posted by yanivfel
                    maybe there is a service or scheduled job trying to run from this comptuer with wrong credentials...

                    check it out...
                    This was going to be my next querie, are you running some sort of service which requires log-on abilities, this could be using the wrong password, wrong user name, or could be using an account which has the wrong privilidges.

                    Check the event Log's security section to see if any password errors are occuring and from what computer they are coming from.

                    B.

                    Comment


                    • #11
                      I have checked, no process or service is using the problematic account. there is also no mapped drive on the user profile or computer. Could be account SID is corrupted. !!!!!!!!!!!!!

                      Comment


                      • #12
                        Originally posted by Satwinder Singh
                        Could be account SID is corrupted. !!!!!!!!!!!!!
                        Try Deleting and re-creating the account with the same priviledges, password, etc etc.

                        Failing this, I am all out of suggestions.

                        B.

                        Comment

                        Working...
                        X