Hi User accounts in active directory are randomly locked out. I would like to find a solution. Security Logs on domain controlers show... Event Type: Failure Audit Event Source: Security Event Category: Account Logon Event ID: 537 Date: 11/05/2004 Time: 10:32:19 a.m. User: NT AUTHORITY\SYSTEM Computer: SERVER Description: An error occurred during logon and Event Type: Failure Audit Event Source: Security Event Category: Account Logon Event ID: 681 Date: 11/05/2004 Time: 10:32:19 a.m. User: NT AUTHORITY\SYSTEM Computer: SERVER Description: The logon to account: USEREXAMPLE by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 from workstation: \\WORKSTATIONEXAMPLE failed. The error code was: 3221226036 and... Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 539 Date: 11/05/2004 Time: 10:32:19a.m. User: NT AUTHORITY\SYSTEM Computer: FS06 Description: Logon Failure: Reason: Account locked out User Name: USEREXAMPLE Domain: SKYNZ Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: \\WORKSTATIONEXAMPLE Debug logging for the Net logon services shows... 1. Our company runs all versions of Microsoft Windows. 200 and XP Workstation, 2000 and 2003 Server. 2. Our Domain Controlers are all 2000 Server with service pack4. 3. Our domain policy is set such that 3 bad attempts locks an account out. Can anyone please help me. What can I do to solve this problem?

When there is a virus infected computer on a network, it randomly tries to logon to different computers and guess at passwords. Sometimes it uses real users names and sometimes they are made up names. My logfiles are full of failed attempts from some infected computer out there on the network. Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: csugod Source Workstation: FHSADMIN Error Code: 0xC0000064 This username is not part of my sub.domain but that source workstation is a real one in another sub.domain located in the same building. But every once in a while, it will use my username from some unknown workstation but because the password is wrong, it could lock out my computer.