Exchange Server Forums

User Account getting locked out randomly

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2003] >> General >> User Account getting locked out randomly

Page: [1]

Message

<< Older Topic Newer Topic >>

User Account getting locked out randomly - 27.Mar.2008 1:53:30 AM

mdimthyas

Posts: 18
Joined: 9.Jan.2007
Status: offline

Hi guys,

Please help me with this. I have a user whose account is getting locked randomly.
Not sure whats the problem is. I have downloaded LockoutStatus.exe and after sometime it shows that his account is logged and also checked the log file.

Its content is like this:

Thu Mar 27 11:14:25 2008, PID: 3772, Thread: 5904, Image ipconfig,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:25 2008, PID: 3772, Thread: 5904, Image ipconfig,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:29 2008, PID: 5804, Thread: 5684, Image /S,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:29 2008, PID: 5204, Thread: 5940, Image /S,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:30 2008, PID: 5016, Thread: 5844, Image /S,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:30 2008, PID: 2664, Thread: 3184, Image C:\WINDOWS\system32\imapi.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:30 2008, PID:   896, Thread: 1024, Image C:\WINDOWS\system32\svchost,***StartServiceW Failed!*** (0), Service: Service: IMAPI CD-Burning COM Service (C:\WINDOWS\system32\imapi.exe), RC was: Incorrect function.   (1), GLE was: The operation completed successfully.   (0)
Thu Mar 27 11:14:31 2008, PID: 3964, Thread: 5352, Image C:\WINDOWS\system32\HDAShCut.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:31 2008, PID: 5016, Thread: 5844, Image /S,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:31 2008, PID: 3964, Thread: 5352, Image C:\WINDOWS\system32\HDAShCut.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:31 2008, PID: 1684, Thread:   832, Image C:\Program Files\Compaq\SetRefresh\SetRefresh.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:32 2008, PID: 1684, Thread:   832, Image C:\Program Files\Compaq\SetRefresh\SetRefresh.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:33 2008, PID: 5884, Thread: 5040, Image C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:34 2008, PID: 5788, Thread: 1672, Image C:\WINDOWS\system32\regsvr32.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:35 2008, PID: 1744, Thread: 1128, Image C:\Program Files\Trend Micro\OfficeScan Client\Pccntmon.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:36 2008, PID: 5408, Thread: 1660, Image C:\WINDOWS\system32\ctfmon.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:37 2008, PID: 5948, Thread: 1612, Image C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:37 2008, PID:   896, Thread: 4260, Image C:\WINDOWS\system32\svchost,***StartServiceW Failed!*** (0), Service: Service: GoogleDesktopManager ("C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe"), RC was: Incorrect function.   (1), GLE was: The operation completed successfully.   (0)
Thu Mar 27 11:14:37 2008, PID: 2664, Thread: 3184, Image C:\WINDOWS\system32\imapi.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:37 2008, PID: 5788, Thread: 1672, Image C:\WINDOWS\system32\regsvr32.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:37 2008, PID: 5948, Thread: 1612, Image C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:49 2008, PID: 2708, Thread: 4376, Image /S,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:49 2008, PID: 2708, Thread: 4376, Image /S,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:53 2008, PID: 3492, Thread: 5244, Image /S,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:53 2008, PID: 3492, Thread: 5244, Image /S,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:53 2008, PID:   736, Thread: 4448, Image /S,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:53 2008, PID:   736, Thread: 4448, Image /S,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:14:53 2008, PID: 5176, Thread: 2736, Image /S,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:14:54 2008, PID: 5176, Thread: 2736, Image /S,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:15:35 2008, PID: 3292, Thread: 6124, Image C:\WINDOWS\System32\WScript.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:15:42 2008, PID: 3292, Thread: 6124, Image C:\WINDOWS\System32\WScript.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:15:42 2008, PID: 5172, Thread: 3276, Image cmd,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:16:11 2008, PID: 4668, Thread: 5212, Image C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Mar 27 11:18:49 2008, PID: 1228, Thread: 6056, Image C:\WINDOWS\system32\DllHost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Mar 27 11:19:46 2008, PID: 5988, Thread: 4928, Image C:\WINDOWS\system32\DllHost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH

Not sure what exactly is causing the problem, I have tried several things, such renaming the profiel, readding the pc to the domain.

I have also disabled a lot of services and tried. Removed the network drives, but its still doing the same.

Can anyone help me with this. I do not have acess to DC's as I am a contractor in the company, so was not able to check the logs.

Please suggest what can be done.

Thanks in advance.

Imtiaz.

Post #: 1

Featured Links*

RE: User Account getting locked out randomly - 27.Mar.2008 9:31:03 AM

uemurad

Posts: 8203
Joined: 7.Jan.2004
From: California, USA
Status: offline

Your question doesn't have anything specific to do with Exchange so don't expect a lot of back-and-forth dialog. However, as you noted more clues lie within the Security Logs on the DC. I will say this about locked accounts - they can be caused by any process that requires authentication, and they could come from any system in the domain. Examples are mapped drives, scheduled tasks, services, a Remote Desktop session. Typically this starts when a password is changed and the process is still using the old password.

_____________________________

Regards,

Dean T. Uemura
Microsoft MVP - Exchange
exchangeguy.blogspot.com
uemurad@yahoo.com

(in reply to mdimthyas)

Post #: 2