security event id 680 Account Lockout

All replies

• 

  

  0

  Sign in to vote

  Please enable the Netlogon Logging to find the machine name
  
  1. Login to the PDC and Enable the Netlogon Logging . Take a look at :-
  
  Enabling debug logging for the Net Logon service
  
  http://support.microsoft.com/default.aspx/kb/109626
  
  2. Now whenever there will be any invalid logon attempt we will get the information under the Netlogon logs .location :- %windir%\debug\netlogon.log
  
  3. Parse the netlogon log with the help of NLPARSER (Account LockoutTools) for following Codes :-
  
  0XC000006A - the value provided for the current password is not correct .
  
  0XC0000234 - The User account has been Automatically Locked .
  
  Get the Result in a .CSV ( Preferred) file .
  
  4.Now with this file you will be able to locate the machine from where these Attempts are comming causing account to be locked .
  
  

  Tuesday, December 8, 2009 6:41 PM
• 

  

  0

  Sign in to vote

  Already did that and the Source Workstation is blank. This makes it hard to find.

  Tuesday, December 8, 2009 6:44 PM
• 

  

  0

  Sign in to vote

  Please check :-
  
  http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/c555206f-d90a-49af-a0dd-66dc4dbff156

  Tuesday, December 8, 2009 7:15 PM
• 

  

  1

  Sign in to vote

  Thanks for the suggestion but I found the problem. The user has a blackberry that was setup to use our access point for Internet connection. He recently changed his password and therefore his Blackberry's password was wrong.

  • Proposed as answer by ADDED_FLAVOUR Tuesday, December 8, 2009 9:17 PM
  • Marked as answer by Wilson Jia Wednesday, December 9, 2009 3:16 AM

  Tuesday, December 8, 2009 9:02 PM