Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So there's a computer on my network at work that has a local account on it. This computer is on the network but not on the domain. The account is used to create gift cards. At least once a week this local account gets locked out. I find this odd because the password is so simple (it might as well be password). It gets locked up at night, so no one is tampering with it. Nothing logs into it remotely. (e.g. scanner for network drives) The local account is used for nothing else, just Windows XP.

Recently the last time this computer was used was on Friday afternoon then put away for a few days. It was then used this morning, or attempted to. But the account was locked. No one was messing with it in the interim.

Any thoughts?

share|improve this question
4  
Open Security Settings (secpol.msc) → Local Policies and enable auditing of logon events (just "logon", not "account logon"). When the account gets locked out, check Event Viewer (eventvwr.msc) → Security. It will show you at least the time and machine name; there might be remote login attempts. – grawity Dec 28 '11 at 13:46
    
Good idea! Thanks for the tip. This will give me a good clue as to what's going on. – Jason T. Dec 28 '11 at 13:51
    
Now that I think about it though, would a failed remote login attempt lock out an account on a computer that's not even turned on? – Jason T. Dec 28 '11 at 13:53
1  
About that - perhaps enable auditing for system events (boot/shutdown) as well? Also, I just remembered: Is this computer using the "Welcome" screen? It may be causing lockouts, since it always tries logging in with a blank password before asking for the real one. – grawity Dec 28 '11 at 14:31
    
Actually yeah it is. I checked the event logs since Audit Logging was already enabled. She had two failed logon attempts and the third entry was a Lockout notification. – Jason T. Dec 28 '11 at 16:20

A few ideas.

  1. Check scheduled tasks have the correct credentials.
  2. Enable login auditing if it's not already enabled (refer to http://technet.microsoft.com/en-us/library/cc787567.aspx)
  3. Disable account lockout (it's disabled on my system, so I guess that's the default):

    Administrative Tools -> Local Security Settings -> Account Policies -> Account Lockout Policy -> Account Lockout Threshold
    
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.