none
Users unable to unlock workstation after sleep RRS feed

  • Question

  • Lately, several of the users in our environment have reported
    being unable to unlock their workstation after it wakes from sleep. 
    They receive an error that their password was incorrect.

    Obviously I have checked with them that the password
    is input correctly. But the fact remains that the password is not accepted.
    I have checked the windows security log and it states flat out
    "Unknown user name or bad password" for these events.
    Users are able to logon normally after rebooting their machine.

    Here's a snippet from the security eventlog for the times users were unable to unlock their machine. 
    (I have changed all the identities with **** for privacy reasons, they all checked out.)

    ___________________________________________________________________________

    Subject:
    Security ID: SYSTEM
    Account Name: **********$
    Account Domain: ***
    Logon ID: 0x3E7

    Logon Type: 7

    Account For Which Logon Failed:
    Security ID: NULL SID
    Account Name:       ******@***.**
    Account Domain:

    Failure Information:
    Failure Reason: Unknown user name or bad password.
    Status: 0xC000006D
    Sub Status: 0xC0000064

    Process Information:
    Caller Process ID: 0xbe0
    Caller Process Name: C:\Windows\System32\svchost.exe

    Network Information:
    Workstation Name: **********
    Source Network Address: 127.0.0.1
    Source Port: 0

    Detailed Authentication Information:
    Logon Process: User32 
    Authentication Package: Negotiate
    Transited Services: -
    Package Name (NTLM only): -
    Key Length: 0
    ___________________________________________________________________________

    Unlocks only fail after returning from a s3 powerstate (sleep). Manual locks/unlocks never fail.
    I've cleaned out the users personal settings and reinstalled their computers. 
    Their setup is identical to other users who don't report these problems. (Windows 10 Enterprise , 1809 )

    We're getting pretty desperate for a solution. It's only a small number of users 
    who persistently report having these issues a few times a week. 
    They work around it by rebooting the machine and logging on to windows. 
    But as you can imagine this is not a desired situation. 

    Any suggestions are very welcome. 

    -Ernst 
    Monday, November 11, 2019 8:44 AM

All replies