Admin account still being locked out

[StockcarsRus]

I had changed my admin password. I went to all services on all servers and changed the logon password for the services that used admin. It is still being locked out every 20 minutes or so. I unlock it and can sign on okay and then maybe 20 minutes later I try to sign on again and the account is locked. Besides the services on the servers, where can I check to see what is trying to use the admin account? In event viewer, for security I only see an entry when the account is locked.


Thanks

 

[Davetoo]

Set your logging to catch everything for an hour, that should point you to the culprit.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[StockcarsRus]

Hi,

I did that, and the only thing for the admin account that came up was associated with the KRBTGT service? I know that has something to do with Kerberos, but I didn't change the password for this account, I can't even find that account anywhere. I think this is the culprit though, although not sure what to do about it.

Thanks for your help and any more suggestions would be appreciated greatly.

Debbie

 

[GlenJohnson]

Is there anything in the event logs?

Glen A. Johnson
"Fall seven times, stand up eight."
Proverb

Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884

 

[StockcarsRus]

Yes, I had only the following for the account...

Event Type:Failure Audit
Event Source:Security
Event Category:Account Logon
Event ID:676
User: NT Authority\system
Computer: Computer Name
Authentication Ticket Request Failed:
User Namethe locked account)
Supplied Realm Name: (Domain)
Service Name:krbtgt\(domain)
Ticket Options: 0x40810010
Failure Code: 0x12
Client Address: (address)

Thanks

 

[GlenJohnson]

Check out

http://www.microsoft.com/technet/tr...windows2000serv/maintain/monitor/logevnts.asp

Glen A. Johnson
"Fall seven times, stand up eight."
Proverb

Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884