Posts

Showing posts from May 18, 2008

Solved Account lockout issue

Today I was working on an issue where an local user account getting locked out with the following event ID:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 5/17/2008
Time: 6:45:00 PM
User: NT AUTHORITY\SYSTEM
Computer: XXXXXXXXXXXXXXX
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: XXXXXXX
Domain: XXXXXXXXXXXX
Logon Type: 4
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: XxXXXXXXXXXXXX

Event IDs 528 and 540 signify a successful logon, event ID 538 a logoff and all the other events in this category identify different reasons for a logon failure. However, just knowing about a successful or failed logon attempt doesn’t fill in the whole picture. B…