Event ID 552 Network Service - Domain Account lockout


  • When the following event occurs on a server, my domain account locks out:

    I have changed my username, Server, and Domain controller in the text below to protect the innocent.

    Event Type: Success Audit

    Event Source: Security

    Event Category: Logon/Logoff 

    Event ID: 552

    Date: 2/3/2012

    Time: 8:30:25 AM


    Computer: SERVERNAME


    Logon attempt using explicit credentials:

     Logged on user:

      User Name: NETWORK SERVICE

      Domain: NT AUTHORITY

      Logon ID: (0x0,0x3E4)

      Logon GUID: -

     User whose credentials were used:

      Target User Name: MYUSERNAME

      Target Domain: NT AUTHORITY

      Target Logon GUID: -


     Target Server Name: Domain Controller

     Target Server Info: Domain Controller

     Caller Process ID: 4

     Source Network Address: -

     Source Port: -

    I cannot pinpoint what is causing the lockout. Process ID 4 is the SYSTEM process. IIS and Sharepoint are running on the server. How can I found out what is configured to RunAs my account under the Network Service account?

    Friday, February 3, 2012 6:02 PM

All replies