Guest Barkingdog Posted April 22, 2008 Posted April 22, 2008 One of our users is running Win XP, Sp2 and intermittently getting this error in their System event log: >>>> Event ID: 40690 Type: Warning Usre: N/A Source: LSASRV Category: SPNEGO (Negotiator) Description: The Security System detected an attempted downgrade attack for server cifs/<servername>.<domainname>.net. The failure code from authentication protocol Kerberos was "The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested. >>> This happens while the user is logged on to their box so I think the description is not fully accurate. I also find that after a period of time ( 1 hour?) the problem seems to correct itself (i.e. disappear). She can now logon. Any ideas how to fix this much appreciated. TIA, barkingdog
Guest Jabez Gan [MVP] Posted April 23, 2008 Posted April 23, 2008 Re: "The user account has been automatically locked...." Whether the user is logged on or not, if another user or bot tries to log on using the user's username but failed for 5 times (default value), Account Lockout policy will block the user from logging on for 1 hour. -- Jabez Gan Microsoft MVP: Windows Server http://www.msblog.org "Barkingdog" <Barkingdog@discussions.microsoft.com> wrote in message news:50173F11-BB50-4911-8F32-53A8635C5DDD@microsoft.com... > One of our users is running Win XP, Sp2 and intermittently getting this > error > in their System event log: > > >>>>> > Event ID: 40690 > Type: Warning > Usre: N/A > Source: LSASRV > Category: SPNEGO (Negotiator) > > Description: > The Security System detected an attempted downgrade attack for server > cifs/<servername>.<domainname>.net. The failure code from authentication > protocol Kerberos was "The user account has been automatically locked > because > too many invalid logon attempts or password change attempts have been > requested. >>>> > > This happens while the user is logged on to their box so I think the > description is not fully accurate. I also find that after a period of time > ( > 1 hour?) the problem seems to correct itself (i.e. disappear). She can now > logon. > > Any ideas how to fix this much appreciated. > > TIA, > > barkingdog >
Guest AllenM Posted April 23, 2008 Posted April 23, 2008 Re: "The user account has been automatically locked...." Has the user recently changed her password? She probably was logged onto another machine when she changed her password. She must still be logged onto that other machine. "Jabez Gan [MVP]" <mingteikg@blizNOSPAMhosting.com> wrote in message news:8B9D5BBA-BD80-410F-96CC-8085D8519526@microsoft.com... > Whether the user is logged on or not, if another user or bot tries to log > on using the user's username but failed for 5 times (default value), > Account Lockout policy will block the user from logging on for 1 hour. > > > -- > Jabez Gan > Microsoft MVP: Windows Server > http://www.msblog.org > > > "Barkingdog" <Barkingdog@discussions.microsoft.com> wrote in message > news:50173F11-BB50-4911-8F32-53A8635C5DDD@microsoft.com... >> One of our users is running Win XP, Sp2 and intermittently getting this >> error >> in their System event log: >> >> >>>>>> >> Event ID: 40690 >> Type: Warning >> Usre: N/A >> Source: LSASRV >> Category: SPNEGO (Negotiator) >> >> Description: >> The Security System detected an attempted downgrade attack for server >> cifs/<servername>.<domainname>.net. The failure code from authentication >> protocol Kerberos was "The user account has been automatically locked >> because >> too many invalid logon attempts or password change attempts have been >> requested. >>>>> >> >> This happens while the user is logged on to their box so I think the >> description is not fully accurate. I also find that after a period of >> time ( >> 1 hour?) the problem seems to correct itself (i.e. disappear). She can >> now >> logon. >> >> Any ideas how to fix this much appreciated. >> >> TIA, >> >> barkingdog >> >
Recommended Posts