Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So there's a computer on my network at work that has a local account on it. This computer is on the network but not on the domain. The account is used to create gift cards. At least once a week this local account gets locked out. I find this odd because the password is so simple (it might as well be password). It gets locked up at night, so no one is tampering with it. Nothing logs into it remotely. (e.g. scanner for network drives) The local account is used for nothing else, just Windows XP.

Recently the last time this computer was used was on Friday afternoon then put away for a few days. It was then used this morning, or attempted to. But the account was locked. No one was messing with it in the interim.

Any thoughts?

share|improve this question
4  
Open Security Settings (secpol.msc) → Local Policies and enable auditing of logon events (just "logon", not "account logon"). When the account gets locked out, check Event Viewer (eventvwr.msc) → Security. It will show you at least the time and machine name; there might be remote login attempts. –  grawity Dec 28 '11 at 13:46
    
Good idea! Thanks for the tip. This will give me a good clue as to what's going on. –  Jason T. Dec 28 '11 at 13:51
    
Now that I think about it though, would a failed remote login attempt lock out an account on a computer that's not even turned on? –  Jason T. Dec 28 '11 at 13:53
1  
About that - perhaps enable auditing for system events (boot/shutdown) as well? Also, I just remembered: Is this computer using the "Welcome" screen? It may be causing lockouts, since it always tries logging in with a blank password before asking for the real one. –  grawity Dec 28 '11 at 14:31
    
Actually yeah it is. I checked the event logs since Audit Logging was already enabled. She had two failed logon attempts and the third entry was a Lockout notification. –  Jason T. Dec 28 '11 at 16:20

2 Answers 2

A few ideas.

  1. Check scheduled tasks have the correct credentials.
  2. Enable login auditing if it's not already enabled (refer to http://technet.microsoft.com/en-us/library/cc787567.aspx)
  3. Disable account lockout (it's disabled on my system, so I guess that's the default):

    Administrative Tools -> Local Security Settings -> Account Policies -> Account Lockout Policy -> Account Lockout Threshold
    
share|improve this answer

I hope this will mark it as solved. So originally the user was using the Welcome Screen. So given this she already had one strike against her. The auditing services were already on. I checked event viewer and she had 3 strikes against her. All stating that she mistyped her password. So presumably she had 1 strike due to the Welcome Screen and the other 2 due to actually mistyping her own password. Go figure, right? I ended up setting that account up to never disable.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.