none
Rapid account locked-out

    Question

  • EventLog

    Event Type:        Failure Audit

    Event Source:    Security

    Event Category:                Account Logon

    Event ID:              680

    Date:                     7/5/2011

    Time:                     3:03:08 PM

    User:                     NT AUTHORITY\SYSTEM

    Computer:          DC

    Description:

    Logon attempt by:           MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

    Logon account:                biswasd

    Source Workstation:      server01-isa

    Error Code:        0xC000006A

     

     

    Event Type:        Failure Audit

    Event Source:    Security

    Event Category:                Account Logon

    Event ID:              680

    Date:                     7/5/2011

    Time:                     3:03:09 PM

    User:                     NT AUTHORITY\SYSTEM

    Computer:          DC

    Description:

    Logon attempt by:           MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

    Logon account:                biswasd

    Source Workstation:      server01-isa

    Error Code:        0xC0000234


    AliahMurfy
    Thursday, July 07, 2011 2:01 PM

Answers

  • So, the source workstation is server01-isa which I suppose is your ISA server.

    The used logon account is biswasd.

    0xC000006A means that the user logon with a misspelled or bad password.

    0xC0000234 means that the user logon with a locked account.

    Please go to your ISA server and check there is a service / application that is running using an old password of this user.

    More if you ask here: http://social.technet.microsoft.com/Forums/en-US/winserversecurity/threads

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified IT Professional: Enterprise Administrator

     

    Thursday, July 07, 2011 2:43 PM
  • For Troubleshooting account lockout issues, please refer the below article.

    Troubleshooting account lockout issues

    http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/cddbf977-b98f-4783-8226-ebddab54d002/

     

    Regards


    MVP-Directory Services 

    Awinish Vishwakarma| CHECK MY BLOG

    Disclaimer: This posting is provided AS-IS with no warranties or guarantees and confers no rights.


    Thursday, July 07, 2011 3:05 PM
    Moderator
  • Here is a direct link to the account troubleshooting:
    http://www.pbbergs.com/windows/articles/UserAccountLockoutTroubleshooting.html

    If while troubleshooting you see a reference to a router, it is most likely a phone or mobile device that is locking the account out.  I see this happening more and more.

    --
    Paul Bergson
    MVP - Directory Services
    MCITP: Enterprise Administrator
    MCTS, MCT, MCSE, MCSA, Security+, BS CSci
    2008, Vista, 2003, 2000 (Early Achiever), NT4
    http://www.pbbergs.com    Twitter @pbbergs
    http://blogs.dirteam.com/blogs/paulbergson

    Please no e-mails, any questions should be posted in the NewsGroup. This posting is provided "AS IS" with no warranties, and confers no rights.

    Friday, July 08, 2011 12:15 PM
    Moderator

All replies

  • Check out my User Account Lockout Troubleshooting artcile at:
    http://www.pbbergs.com/windows/articles.htm

    --
    Paul Bergson
    MVP - Directory Services
    MCITP: Enterprise Administrator
    MCTS, MCT, MCSE, MCSA, Security+, BS CSci
    2008, Vista, 2003, 2000 (Early Achiever), NT4
    http://www.pbbergs.com    Twitter @pbbergs
    http://blogs.dirteam.com/blogs/paulbergson

    Please no e-mails, any questions should be posted in the NewsGroup. This posting is provided "AS IS" with no warranties, and confers no rights.

    Thursday, July 07, 2011 2:21 PM
    Moderator
  • So, the source workstation is server01-isa which I suppose is your ISA server.

    The used logon account is biswasd.

    0xC000006A means that the user logon with a misspelled or bad password.

    0xC0000234 means that the user logon with a locked account.

    Please go to your ISA server and check there is a service / application that is running using an old password of this user.

    More if you ask here: http://social.technet.microsoft.com/Forums/en-US/winserversecurity/threads

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified IT Professional: Enterprise Administrator

     

    Thursday, July 07, 2011 2:43 PM
  • For Troubleshooting account lockout issues, please refer the below article.

    Troubleshooting account lockout issues

    http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/cddbf977-b98f-4783-8226-ebddab54d002/

     

    Regards


    MVP-Directory Services 

    Awinish Vishwakarma| CHECK MY BLOG

    Disclaimer: This posting is provided AS-IS with no warranties or guarantees and confers no rights.


    Thursday, July 07, 2011 3:05 PM
    Moderator
  • Awinish,

    There is no content on your link.


    AliahMurfy
    Friday, July 08, 2011 6:27 AM
  • Aliah, i have corrected the broken link.

     

    Regards  


    MVP-Directory Services

    Awinish Vishwakarma| CHECK MY BLOG

    Disclaimer: This posting is provided AS-IS with no warranties or guarantees and confers no rights.

    Friday, July 08, 2011 7:14 AM
    Moderator
  • Here is a direct link to the account troubleshooting:
    http://www.pbbergs.com/windows/articles/UserAccountLockoutTroubleshooting.html

    If while troubleshooting you see a reference to a router, it is most likely a phone or mobile device that is locking the account out.  I see this happening more and more.

    --
    Paul Bergson
    MVP - Directory Services
    MCITP: Enterprise Administrator
    MCTS, MCT, MCSE, MCSA, Security+, BS CSci
    2008, Vista, 2003, 2000 (Early Achiever), NT4
    http://www.pbbergs.com    Twitter @pbbergs
    http://blogs.dirteam.com/blogs/paulbergson

    Please no e-mails, any questions should be posted in the NewsGroup. This posting is provided "AS IS" with no warranties, and confers no rights.

    Friday, July 08, 2011 12:15 PM
    Moderator
  • I get this same error while logged into a domain workstation as the domain admin. The error occurs when I run a SCAP compliance tool. The tool runs w/ the logged-in credentials which were confirmed by the mere logging in beforehand.

    From the workstations I can map shares and connect to remote registry

    What would cause correct credential to be deemed incorrect?


    Jeremy

    Friday, August 16, 2013 9:26 PM