locked
security event id 680 Account Lockout RRS feed

  • Question

  • I am getting lockout evey 5 minutes on the user sgaonkar and no workstation is listed in the Doman Controller events (see below). Any ideas as to where this is coming from?

    Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
     Logon account: sgaonkar
     Source Workstation: 
     Error Code: 0xC0000234
    Tuesday, December 8, 2009 6:09 PM

Answers

  • Thanks for the suggestion but I found the problem. The user has a blackberry that was setup to use our access point for Internet connection. He recently changed his password and therefore his Blackberry's password was wrong.
    • Proposed as answer by ADDED_FLAVOUR Tuesday, December 8, 2009 9:17 PM
    • Marked as answer by Wilson Jia Wednesday, December 9, 2009 3:16 AM
    Tuesday, December 8, 2009 9:02 PM

All replies

  • Please enable the Netlogon Logging to find the machine name

    1. Login to the PDC and Enable the Netlogon Logging . Take a look at :-

    Enabling debug logging for the Net Logon service

    http://support.microsoft.com/default.aspx/kb/109626

    2. Now whenever there will be any invalid logon attempt we will get the information under the Netlogon logs .location :- %windir%\debug\netlogon.log

    3. Parse the netlogon log with the help of NLPARSER (Account LockoutTools) for following Codes :-

    0XC000006A - the value provided for the current password is not correct .

    0XC0000234 - The User account has been Automatically Locked .

    Get the Result in a .CSV ( Preferred) file .

    4.Now with this file you will be able to locate the machine from where these Attempts are comming causing account to be locked .

    Tuesday, December 8, 2009 6:41 PM
  • Already did that and the Source Workstation is blank. This makes it hard to find.
    Tuesday, December 8, 2009 6:44 PM
  • Thanks for the suggestion but I found the problem. The user has a blackberry that was setup to use our access point for Internet connection. He recently changed his password and therefore his Blackberry's password was wrong.
    • Proposed as answer by ADDED_FLAVOUR Tuesday, December 8, 2009 9:17 PM
    • Marked as answer by Wilson Jia Wednesday, December 9, 2009 3:16 AM
    Tuesday, December 8, 2009 9:02 PM