Announcement

Collapse
No announcement yet.

Can someone help me solve the problem regarding accout lock

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Can someone help me solve the problem regarding accout lock

    Hello everyone.

    The domain cotroller (NT4) at our company seems under attack. Every account including administrator is automatically locked out. Even I logon with administrator it will be locked within in tens of seconds to one miniute.

    I appreciate any suggestion or solution from your help.

    Jimmy

  • #2
    Hi,

    1) At once scan ur m/c with the virus scanner, Ensure the scanner is updated one.

    2) Observe, is there any internal security breach, or any script is running which periodically locks all the accounts.

    3) Look in to the task manager/ schedule task for any suspicious process.

    4) Look in the Event log for any clues(definetly there must be some clues), Also enable the auditing for account logon process.


    And also provide some more info and ur observation.


    skm_mail MCSE, SCSA, CCNP
    Systems Administrator
    INDIA

    Comment


    • #3
      Further information regarding the problem.

      Hi, thanks for the hint.
      After the probing I found that some clients in the LAN were frequently sending logon requests to the server. I suppose that's because of virus. I found in one computer that there is one suspecious file named svchos.exe refered by "windows update" item. I am not sure about the meaning of this file because as I know, there is a well-known file called svchost.exe while in this computer there is this file with svchos.exe coexistance. Any ideas?
      Thank you for your time.
      Jimmy

      Comment


      • #4
        svchos.exe must be virus. run the virus scanner at once.


        skm_mail MCSE, SCSA, CCNP
        Systems Administrator
        INDIA

        Comment

        Working...
        X