locked
UserPinService: Found users who are already or about to be permanently locked RRS feed

  • Question

  • Hello,

    I have been getting this annoying message about: 

    [Skype] Found users who are already or about to be permanently locked

    I worked with a great team at microsoft with my contact being Yogaprakash.

    Here is what we found:

    Monitor Name: UserPinService: Found users who are already or about to be permanently locked

    Alert Name: [Skype] Found users who are already or about to be permanently locked

    Monitor Configuration:

    <Configuration>

      <ComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Lync Server</LogName>

      <ErrorExpression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">47066</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">LS UserPin Service</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </ErrorExpression>

      <AutoResolveInterval>7200</AutoResolveInterval>

    </Configuration>

    So as per the above monitor configuration, SCOM monitoring the event id 47066 published by LS UserPin Service Source on the Skype servers.

    The above monitor is from the Skype for Business 2015 Management Pack and it’s sealed management pack.

    SCOM Skype for Business

    We can’t make any changes with respect to increase/decrease the time interval for this monitor to execute to monitor the event id mentioned above due to sealed management pack from Microsoft.

    Below are the only override parameters which are available or exposed to make changes

    Override Parameters:

    UserPINService

    As SCOM is looking for the event id 47066 published by LS UserPin Service Source on the Skype servers, when this event id logged, SCOM will generate an alert.

    Full details about this monitor:UPIN_FOUND_PERMANENTLY_LOCKED_USERS

    I hope this helps.

    Thanks

    Rob

    Tuesday, May 2, 2017 7:12 PM

All replies

  • Hi Rob,

    Did this issue occur to all users? Or specific user?

    To this issue, please try to reset PIN, because this error may be caused by old PIN.


    Best Regards,
    Jim Xu
    TechNet Community Support


    Please remember to mark the replies as answers if they helped.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Proposed as answer by jim-xu Sunday, May 7, 2017 1:20 AM
    Wednesday, May 3, 2017 5:01 AM
  • Hello Rob,

    If you have like Polycom devices in your environment with pin auth and sometimes users forget to sign out of the device. Then the PIN change and the logged in polycom will try to log in continue on the device.

    Check with Cs-Connections script https://www.ucunleashed.com/269 if the user is logged in somewhere.

    Greetings,

    Erdem


    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

    Wednesday, May 3, 2017 7:32 AM