• RSS
  • Twitter
  • FaceBook

Exchange Server Forums

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

User Account getting locked out randomly

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [Microsoft Exchange 2003] >> General >> User Account getting locked out randomly Page: [1]
Login
Message << Older Topic   Newer Topic >>
User Account getting locked out randomly - 27.Mar.2008 1:53:30 AM   
mdimthyas

 

Posts: 18
Joined: 9.Jan.2007
Status: offline
Hi guys,

Please help me with this. I have a user whose account is getting locked randomly.
Not sure whats the problem is. I have downloaded LockoutStatus.exe and after sometime it shows that his account is logged and also checked the log file.

Its content is like this:

Thu Mar 27 11:14:25 2008, PID:  3772, Thread:  5904, Image ipconfig,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:25 2008, PID:  3772, Thread:  5904, Image ipconfig,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:29 2008, PID:  5804, Thread:  5684, Image /S,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:29 2008, PID:  5204, Thread:  5940, Image /S,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:30 2008, PID:  5016, Thread:  5844, Image /S,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:30 2008, PID:  2664, Thread:  3184, Image C:\WINDOWS\system32\imapi.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:30 2008, PID:   896, Thread:  1024, Image C:\WINDOWS\system32\svchost,***StartServiceW Failed!*** (0), Service: Service: IMAPI CD-Burning COM Service (C:\WINDOWS\system32\imapi.exe), RC was: Incorrect function.   (1), GLE was: The operation completed successfully.   (0)
Thu Mar 27 11:14:31 2008, PID:  3964, Thread:  5352, Image C:\WINDOWS\system32\HDAShCut.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:31 2008, PID:  5016, Thread:  5844, Image /S,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:31 2008, PID:  3964, Thread:  5352, Image C:\WINDOWS\system32\HDAShCut.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:31 2008, PID:  1684, Thread:   832, Image C:\Program Files\Compaq\SetRefresh\SetRefresh.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:32 2008, PID:  1684, Thread:   832, Image C:\Program Files\Compaq\SetRefresh\SetRefresh.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:33 2008, PID:  5884, Thread:  5040, Image C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:34 2008, PID:  5788, Thread:  1672, Image C:\WINDOWS\system32\regsvr32.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:35 2008, PID:  1744, Thread:  1128, Image C:\Program Files\Trend Micro\OfficeScan Client\Pccntmon.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:36 2008, PID:  5408, Thread:  1660, Image C:\WINDOWS\system32\ctfmon.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:37 2008, PID:  5948, Thread:  1612, Image C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:37 2008, PID:   896, Thread:  4260, Image C:\WINDOWS\system32\svchost,***StartServiceW Failed!*** (0), Service: Service: GoogleDesktopManager ("C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe"), RC was: Incorrect function.   (1), GLE was: The operation completed successfully.   (0)
Thu Mar 27 11:14:37 2008, PID:  2664, Thread:  3184, Image C:\WINDOWS\system32\imapi.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:37 2008, PID:  5788, Thread:  1672, Image C:\WINDOWS\system32\regsvr32.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:37 2008, PID:  5948, Thread:  1612, Image C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:49 2008, PID:  2708, Thread:  4376, Image /S,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:49 2008, PID:  2708, Thread:  4376, Image /S,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:53 2008, PID:  3492, Thread:  5244, Image /S,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:53 2008, PID:  3492, Thread:  5244, Image /S,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:53 2008, PID:   736, Thread:  4448, Image /S,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:53 2008, PID:   736, Thread:  4448, Image /S,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:53 2008, PID:  5176, Thread:  2736, Image /S,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:54 2008, PID:  5176, Thread:  2736, Image /S,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:15:35 2008, PID:  3292, Thread:  6124, Image C:\WINDOWS\System32\WScript.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:15:42 2008, PID:  3292, Thread:  6124, Image C:\WINDOWS\System32\WScript.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:15:42 2008, PID:  5172, Thread:  3276, Image cmd,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:16:11 2008, PID:  4668, Thread:  5212, Image C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:18:49 2008, PID:  1228, Thread:  6056, Image C:\WINDOWS\system32\DllHost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:19:46 2008, PID:  5988, Thread:  4928, Image C:\WINDOWS\system32\DllHost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH

Not sure what exactly is causing the problem, I have tried several things, such renaming the profiel, readding the pc to the domain.

I have also disabled a lot of services and tried. Removed the network drives, but its still doing the same.

Can anyone help me with this. I do not have acess to DC's as I am a contractor in the company, so was not able to check the logs.

Please suggest what can be done.

Thanks in advance.

Imtiaz.
Post #: 1
RE: User Account getting locked out randomly - 27.Mar.2008 9:31:03 AM   
uemurad

 

Posts: 8232
Joined: 7.Jan.2004
From: California, USA
Status: offline
Your question doesn't have anything specific to do with Exchange so don't expect a lot of back-and-forth dialog.  However, as you noted more clues lie within the Security Logs on the DC.  I will say this about locked accounts - they can be caused by any process that requires authentication, and they could come from any system in the domain.  Examples are mapped drives, scheduled tasks, services, a Remote Desktop session.  Typically this starts when a password is changed and the process is still using the old password.

_____________________________

Regards,

Dean T. Uemura
Microsoft MVP - Exchange (2007-2011)
exchangeguy.blogspot.com
uemurad@yahoo.com

(in reply to mdimthyas)
Post #: 2

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [Microsoft Exchange 2003] >> General >> User Account getting locked out randomly Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts


Follow TechGenix on Twitter