locked account

[Mattias Albinsson]

I have a windows 2000 environment with 3 DC. Problem: When the users have to change password, the users account gets locked out every 30 minutes when he or she tries to access a share or Outlook.(I have too unlock it from AD) I have had the users put in the new password directly in AD using reset password. But same result.

BR

Mattias

[Rune J. Winje]

One reason could be shares mapped with the old password, these could result in the 'bad password' count going over your defined limit and thus locking out the account.

What SP do you have?

Some suggestions:
SMB Session Credentials Are Not Updated After Password Change Resulting in Account Lockout
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q275508
(Fixed in SP2)

Increased Account Lockout Frequency in Windows 2000 Domain
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q264678

There are also some known issues fixed in SP3 - including not resetting the 'bad password' count and AD-problems.

So:
1) Consider upgrading to SP3 if not already done
2) Examine Group Policies for the number of permitted bad password count
3) Examine if users have network shares or automatic processes using the old passwords (check security log and see if consecutive bad password logon attempts happen within a short time-period (subsecond))


Cheers,
Rune

[Sam Cochran]

We had a similar problem...
our workaround was to have
the users log off and log
back on immediately after
they changed their password.