Posts

Showing posts from May 18, 2008

Solved Account lockout issue

Today I was working on an issue where an local user account getting locked out with the following event ID: Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 529 Date: 5/17/2008 Time: 6:45:00 PM User: NT AUTHORITY\SYSTEM Computer: XXXXXXXXXXXXXXX Description: Logon Failure: Reason: Unknown user name or bad password User Name: XXXXXXX Domain: XXXXXXXXXXXX Logon Type: 4 Logon Process: Advapi Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: XxXXXXXXXXXXXX Event IDs 528 and 540 signify a successful logon, event ID 538 a logoff and all the other events in this category identify different reasons for a logon failure. However, just knowing about a successful or failed logon attempt doesn’t fill in the