We have a serious problem with a user. that is locked out "in background" during work, which means:
the user is logged on to the domain controller. she has some network drives that are mapped by the login script (as all the other users too), and she has a personal mapped drive, that requires a username/pw to a specific share (as like 10 other users too!).
During the day, i can see 5 unsucessful logins in 3-5seconds, which have the Logon Type 7. (usually login after screensaver or so).
But the user was just working, she didn't have any screensaver launched, and she wasn't away. We can exclude any other person trying to log on to her computer.
It's a failure audit, source security, with event id 529
Logon Failure: Reason: Unknown user name or bad password User Name: <her name> Domain: <our domain> Logon Type: 7 Logon Process: User32 Authentication Package: Negotiate Workstation Name: <her ws>
after that, she gets 3 logs, event id 539, user locked out.
it's invisible to her, she can continue working, but when she tries to access the share, she has no acces (..as she got locked out).
Computer runs Win Xp Sp3, DC is a Win 2008 R2. As some people have exactly the same config as she has, it's very strange, and i don't know where to continue searching...
i've read like half the internet about the lockout problems, but the solutions were not appropriate for ou problem. What could cause this problem ?
btw: gpo is set to 5 tries beore lockout, and it can NOT be changed to a higher number (some site suggested that, cause of network information that has been lost...). Or is this the only reason ? Is windows trying to connect several times to the network share ??
What i did, is that she has disconnectd the mapped drive, and now uses the direct network path, while i'm looking for an answer and so i can monitor if the event occurs again