"The user account has been automatically locked...."

  • Thread starter Thread starter Barkingdog
  • Start date Start date
B

Barkingdog

Guest
One of our users is running Win XP, Sp2 and intermittently getting this error
in their System event log:


>>>>
Event ID: 40690
Type: Warning
Usre: N/A
Source: LSASRV
Category: SPNEGO (Negotiator)

Description:
The Security System detected an attempted downgrade attack for server
cifs/<servername>.<domainname>.net. The failure code from authentication
protocol Kerberos was "The user account has been automatically locked because
too many invalid logon attempts or password change attempts have been
requested.
>>>

This happens while the user is logged on to their box so I think the
description is not fully accurate. I also find that after a period of time (
1 hour?) the problem seems to correct itself (i.e. disappear). She can now
logon.

Any ideas how to fix this much appreciated.

TIA,

barkingdog
 
Re: "The user account has been automatically locked...."

Whether the user is logged on or not, if another user or bot tries to log on
using the user's username but failed for 5 times (default value), Account
Lockout policy will block the user from logging on for 1 hour.


--
Jabez Gan
Microsoft MVP: Windows Server
http://www.msblog.org


"Barkingdog" <Barkingdog@discussions.microsoft.com> wrote in message
news:50173F11-BB50-4911-8F32-53A8635C5DDD@microsoft.com...
> One of our users is running Win XP, Sp2 and intermittently getting this
> error
> in their System event log:
>
>
>>>>>
> Event ID: 40690
> Type: Warning
> Usre: N/A
> Source: LSASRV
> Category: SPNEGO (Negotiator)
>
> Description:
> The Security System detected an attempted downgrade attack for server
> cifs/<servername>.<domainname>.net. The failure code from authentication
> protocol Kerberos was "The user account has been automatically locked
> because
> too many invalid logon attempts or password change attempts have been
> requested.
>>>>
>
> This happens while the user is logged on to their box so I think the
> description is not fully accurate. I also find that after a period of time
> (
> 1 hour?) the problem seems to correct itself (i.e. disappear). She can now
> logon.
>
> Any ideas how to fix this much appreciated.
>
> TIA,
>
> barkingdog
>
 
Re: "The user account has been automatically locked...."

Has the user recently changed her password? She probably was logged onto
another machine when she changed her password. She must still be logged onto
that other machine.


"Jabez Gan [MVP]" <mingteikg@blizNOSPAMhosting.com> wrote in message
news:8B9D5BBA-BD80-410F-96CC-8085D8519526@microsoft.com...
> Whether the user is logged on or not, if another user or bot tries to log
> on using the user's username but failed for 5 times (default value),
> Account Lockout policy will block the user from logging on for 1 hour.
>
>
> --
> Jabez Gan
> Microsoft MVP: Windows Server
> http://www.msblog.org
>
>
> "Barkingdog" <Barkingdog@discussions.microsoft.com> wrote in message
> news:50173F11-BB50-4911-8F32-53A8635C5DDD@microsoft.com...
>> One of our users is running Win XP, Sp2 and intermittently getting this
>> error
>> in their System event log:
>>
>>
>>>>>>
>> Event ID: 40690
>> Type: Warning
>> Usre: N/A
>> Source: LSASRV
>> Category: SPNEGO (Negotiator)
>>
>> Description:
>> The Security System detected an attempted downgrade attack for server
>> cifs/<servername>.<domainname>.net. The failure code from authentication
>> protocol Kerberos was "The user account has been automatically locked
>> because
>> too many invalid logon attempts or password change attempts have been
>> requested.
>>>>>
>>
>> This happens while the user is logged on to their box so I think the
>> description is not fully accurate. I also find that after a period of
>> time (
>> 1 hour?) the problem seems to correct itself (i.e. disappear). She can
>> now
>> logon.
>>
>> Any ideas how to fix this much appreciated.
>>
>> TIA,
>>
>> barkingdog
>>
>
 
Back
Top