URGENT NT Passwords Keep Getting Locked Out

[Ed]

Archived from groups: microsoft.public.windowsnt.domain (More info?)

I keep getting NT passwords locked out with the event ID below. Also
with other machine names and non existing domains. Any advice?

Thanks Ed


Event ID 539
Source: Security
Type: Failure Audit
Category: Login/Logoff


Logon Failure:
Reason: Account locked out
User Name: allard
Domain: AMD1700
Logon Type: 3
Logon Process: KSecDD
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: \\AMD1700

 

[Ed]

Archived from groups: microsoft.public.windowsnt.domain (More info?)

Im also getting virus messages W32.Randex.gen

W32.Randex.gen
http://securityresponse.symantec.com/avcenter/venc/data/w32.randex.gen.html




On Tue, 13 Apr 2004 10:17:18 -0700, Ed <jonesej@isi.edu> wrote:

>
>I keep getting NT passwords locked out with the event ID below. Also
>with other machine names and non existing domains. Any advice?
>
>Thanks Ed
>
>
>Event ID 539
>Source: Security
>Type: Failure Audit
>Category: Login/Logoff
>
>
>Logon Failure:
> Reason: Account locked out
> User Name: allard
> Domain: AMD1700
> Logon Type: 3
> Logon Process: KSecDD
> Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Workstation Name: \\AMD1700

 

[Ed]

Archived from groups: microsoft.public.windowsnt.domain (More info?)

First anyway to see were login attempts are coming from?






On Tue, 13 Apr 2004 10:17:18 -0700, Ed <jonesej@isi.edu> wrote:

>
>I keep getting NT passwords locked out with the event ID below. Also
>with other machine names and non existing domains. Any advice?
>
>Thanks Ed
>
>
>Event ID 539
>Source: Security
>Type: Failure Audit
>Category: Login/Logoff
>
>
>Logon Failure:
> Reason: Account locked out
> User Name: allard
> Domain: AMD1700
> Logon Type: 3
> Logon Process: KSecDD
> Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Workstation Name: \\AMD1700

 

[Guy]

Archived from groups: microsoft.public.windowsnt.domain (More info?)

I was having the same problem and here's how I fixed it. I have IIS
running locally on my machine and found that I had configured one of
the webs to use my account for anonymous access instead of the
IUSR_Machine account.

If this sounds like a situation you may have, open Internet Services
Manager. Right click on a web, choose properties, choose directory
Security, chose Edit for the Anonymous Access section at the top, If
the Anonymous Access item is checked click the Edit button, check the
username and password that is entered there. If it's IUSR_xxxx then
leave it. If it's your username then correct the password.