Account Locking problem - Culrpit is exchange server please help

My problem is my account locks out every 10 minutes.  (W2K domain)  No other 
account has a problem.  Over the past 3 days I have narrowed it down to the 
exchange server.  

Shut each DC down one at a time acct still locks.
Shut don exchange server account doesnt lock
Shut down exchange service acct still locks
I have also shut down all non MS services and the acct still locks

I am confident the problem exists on the exchange server seperate from the 
exchange services.  The MS services that are running on the Exchange 2000 
server are:

alerter
computer browser
dist file system
dhcp cllient
logical disk mgr
dns client
event log
com+ event system
IIS admin
server
workstation
license logging service
tcp/ip netbios helper
messenger
distributed transaction coordinator
MS Exch information store
MS Exch system attendant
net logon
network connections
network news transport protocol
NT LM security support prov
plug n play
IPSEC policy agent
protected storage
remote registry
MS Exch routing engine
RPC locator
RPC
SAM
task scheduler
run as
system event
smtp
print spooler
term services
dist link tracking client
windows time
WWW publihing
windows mgt instrumentaion
windows mgt instrumentaion driver
automatic updates

Of these which ones can I safely shut down w/o affecting exchange during 
production.  I can then shut the others down after hours.  

Any suggestions would greatly appreciated as my next step may require 
gasoline a match and a pack of hotdogs.  

Thanks in advance.
Cody
0
CodyLewis (9)
7/21/2006 4:46:02 PM
exchange.admin 57650 articles. 2 followers. Follow

15 Replies
540 Views

Similar Articles

[PageSpeed] 30
See related articles to this posting 


On Fri, 21 Jul 2006 09:46:02 -0700, Cody Lewis
<CodyLewis@discussions.microsoft.com> wrote:

>My problem is my account locks out every 10 minutes.  (W2K domain)  No other 
>account has a problem.  Over the past 3 days I have narrowed it down to the 
>exchange server.  

What do you mean you narrowed it down to the Exch Server?
What do the security event logs say?

>
>Shut each DC down one at a time acct still locks.
>Shut don exchange server account doesnt lock
>Shut down exchange service acct still locks
>I have also shut down all non MS services and the acct still locks
>
>I am confident the problem exists on the exchange server seperate from the 
>exchange services.  The MS services that are running on the Exchange 2000 
>server are:
>
>alerter
>computer browser
>dist file system
>dhcp cllient
>logical disk mgr
>dns client
>event log
>com+ event system
>IIS admin
>server
>workstation
>license logging service
>tcp/ip netbios helper
>messenger
>distributed transaction coordinator
>MS Exch information store
>MS Exch system attendant
>net logon
>network connections
>network news transport protocol
>NT LM security support prov
>plug n play
>IPSEC policy agent
>protected storage
>remote registry
>MS Exch routing engine
>RPC locator
>RPC
>SAM
>task scheduler
>run as
>system event
>smtp
>print spooler
>term services
>dist link tracking client
>windows time
>WWW publihing
>windows mgt instrumentaion
>windows mgt instrumentaion driver
>automatic updates
>
>Of these which ones can I safely shut down w/o affecting exchange during 
>production.  I can then shut the others down after hours.  
>
>Any suggestions would greatly appreciated as my next step may require 
>gasoline a match and a pack of hotdogs.  
>
>Thanks in advance.
>Cody
0
adavid (8731)
7/21/2006 5:41:01 PM 
Instead of trying to shut down services, why don't you look at the services 
that are started from the Services Applet, and see if any of them are 
configured to run as your account?  If so, which ones?

-- 
Ben Winzenz
Exchange MVP
MessageOne
Read my blog!
http://winzenz.blogspot.com
http://feeds.feedburner.com/winzenz (RSS Feed)


"Cody Lewis" <CodyLewis@discussions.microsoft.com> wrote in message 
news:FC23EF79-76B6-4F0D-B40D-3678360B083F@microsoft.com...
> My problem is my account locks out every 10 minutes.  (W2K domain)  No 
> other
> account has a problem.  Over the past 3 days I have narrowed it down to 
> the
> exchange server.
>
> Shut each DC down one at a time acct still locks.
> Shut don exchange server account doesnt lock
> Shut down exchange service acct still locks
> I have also shut down all non MS services and the acct still locks
>
> I am confident the problem exists on the exchange server seperate from the
> exchange services.  The MS services that are running on the Exchange 2000
> server are:
>
> alerter
> computer browser
> dist file system
> dhcp cllient
> logical disk mgr
> dns client
> event log
> com+ event system
> IIS admin
> server
> workstation
> license logging service
> tcp/ip netbios helper
> messenger
> distributed transaction coordinator
> MS Exch information store
> MS Exch system attendant
> net logon
> network connections
> network news transport protocol
> NT LM security support prov
> plug n play
> IPSEC policy agent
> protected storage
> remote registry
> MS Exch routing engine
> RPC locator
> RPC
> SAM
> task scheduler
> run as
> system event
> smtp
> print spooler
> term services
> dist link tracking client
> windows time
> WWW publihing
> windows mgt instrumentaion
> windows mgt instrumentaion driver
> automatic updates
>
> Of these which ones can I safely shut down w/o affecting exchange during
> production.  I can then shut the others down after hours.
>
> Any suggestions would greatly appreciated as my next step may require
> gasoline a match and a pack of hotdogs.
>
> Thanks in advance.
> Cody
0
Ben
7/21/2006 5:43:38 PM 

"Andy David - MVP" wrote:

> On Fri, 21 Jul 2006 09:46:02 -0700, Cody Lewis
> <CodyLewis@discussions.microsoft.com> wrote:
> 
> >My problem is my account locks out every 10 minutes.  (W2K domain)  No other 
> >account has a problem.  Over the past 3 days I have narrowed it down to the 
> >exchange server.  
> 
> What do you mean you narrowed it down to the Exch Server?

Do these steps listed  not direct the problem to the exchange server?
Shut each DC down one at a time acct still locks.
Shut don exchange server account doesnt lock
Shut down exchange service acct still locks
I have also shut down all non MS services and the acct still locks
 What do the security event logs say?

Sorry should have included that
I get Event 539 Logon process ADVAPI logon type 3 followed by Event 681 
Error code was 321225572, these errors repeat until acct is locked.  I have 
the policy set at 10 bad attempts until lockout.

> 
> >
> >Shut each DC down one at a time acct still locks.
> >Shut don exchange server account doesnt lock
> >Shut down exchange service acct still locks
> >I have also shut down all non MS services and the acct still locks
> >
> >I am confident the problem exists on the exchange server seperate from the 
> >exchange services.  The MS services that are running on the Exchange 2000 
> >server are:
> >
> >alerter
> >computer browser
> >dist file system
> >dhcp cllient
> >logical disk mgr
> >dns client
> >event log
> >com+ event system
> >IIS admin
> >server
> >workstation
> >license logging service
> >tcp/ip netbios helper
> >messenger
> >distributed transaction coordinator
> >MS Exch information store
> >MS Exch system attendant
> >net logon
> >network connections
> >network news transport protocol
> >NT LM security support prov
> >plug n play
> >IPSEC policy agent
> >protected storage
> >remote registry
> >MS Exch routing engine
> >RPC locator
> >RPC
> >SAM
> >task scheduler
> >run as
> >system event
> >smtp
> >print spooler
> >term services
> >dist link tracking client
> >windows time
> >WWW publihing
> >windows mgt instrumentaion
> >windows mgt instrumentaion driver
> >automatic updates
> >
> >Of these which ones can I safely shut down w/o affecting exchange during 
> >production.  I can then shut the others down after hours.  
> >
> >Any suggestions would greatly appreciated as my next step may require 
> >gasoline a match and a pack of hotdogs.  
> >
> >Thanks in advance.
> >Cody
>
0
CodyLewis (9)
7/21/2006 5:57:02 PM 
On Fri, 21 Jul 2006 10:57:02 -0700, Cody Lewis
<CodyLewis@discussions.microsoft.com> wrote:

>
>
>"Andy David - MVP" wrote:
>
>> On Fri, 21 Jul 2006 09:46:02 -0700, Cody Lewis
>> <CodyLewis@discussions.microsoft.com> wrote:
>> 
>> >My problem is my account locks out every 10 minutes.  (W2K domain)  No other 
>> >account has a problem.  Over the past 3 days I have narrowed it down to the 
>> >exchange server.  
>> 
>> What do you mean you narrowed it down to the Exch Server?
>
>Do these steps listed  not direct the problem to the exchange server?
>Shut each DC down one at a time acct still locks.
>Shut don exchange server account doesnt lock
>Shut down exchange service acct still locks
>I have also shut down all non MS services and the acct still locks
> What do the security event logs say?
>
>Sorry should have included that
>I get Event 539 Logon process ADVAPI logon type 3 followed by Event 681 
>Error code was 321225572, these errors repeat until acct is locked.  I have 
>the policy set at 10 bad attempts until lockout.

Right, but the security logs typically show the calling server (either
one the server in question or on the DC the account gets locked on),
so I am wondering why you went through all those steps.
Logon type 3 is a network logon, so it could be logon to IIS, or a
shared printer or mapped drive, etc///

>
>> 
>> >
>> >Shut each DC down one at a time acct still locks.
>> >Shut don exchange server account doesnt lock
>> >Shut down exchange service acct still locks
>> >I have also shut down all non MS services and the acct still locks
>> >
>> >I am confident the problem exists on the exchange server seperate from the 
>> >exchange services.  The MS services that are running on the Exchange 2000 
>> >server are:
>> >
>> >alerter
>> >computer browser
>> >dist file system
>> >dhcp cllient
>> >logical disk mgr
>> >dns client
>> >event log
>> >com+ event system
>> >IIS admin
>> >server
>> >workstation
>> >license logging service
>> >tcp/ip netbios helper
>> >messenger
>> >distributed transaction coordinator
>> >MS Exch information store
>> >MS Exch system attendant
>> >net logon
>> >network connections
>> >network news transport protocol
>> >NT LM security support prov
>> >plug n play
>> >IPSEC policy agent
>> >protected storage
>> >remote registry
>> >MS Exch routing engine
>> >RPC locator
>> >RPC
>> >SAM
>> >task scheduler
>> >run as
>> >system event
>> >smtp
>> >print spooler
>> >term services
>> >dist link tracking client
>> >windows time
>> >WWW publihing
>> >windows mgt instrumentaion
>> >windows mgt instrumentaion driver
>> >automatic updates
>> >
>> >Of these which ones can I safely shut down w/o affecting exchange during 
>> >production.  I can then shut the others down after hours.  
>> >
>> >Any suggestions would greatly appreciated as my next step may require 
>> >gasoline a match and a pack of hotdogs.  
>> >
>> >Thanks in advance.
>> >Cody
>>
0
adavid (8731)
7/21/2006 6:05:20 PM 
I have dont that as well.  All services run as the administrator acct.  

"Ben Winzenz [Exchange MVP]" wrote:

> Instead of trying to shut down services, why don't you look at the services 
> that are started from the Services Applet, and see if any of them are 
> configured to run as your account?  If so, which ones?
> 
> -- 
> Ben Winzenz
> Exchange MVP
> MessageOne
> Read my blog!
> http://winzenz.blogspot.com
> http://feeds.feedburner.com/winzenz (RSS Feed)
> 
> 
> "Cody Lewis" <CodyLewis@discussions.microsoft.com> wrote in message 
> news:FC23EF79-76B6-4F0D-B40D-3678360B083F@microsoft.com...
> > My problem is my account locks out every 10 minutes.  (W2K domain)  No 
> > other
> > account has a problem.  Over the past 3 days I have narrowed it down to 
> > the
> > exchange server.
> >
> > Shut each DC down one at a time acct still locks.
> > Shut don exchange server account doesnt lock
> > Shut down exchange service acct still locks
> > I have also shut down all non MS services and the acct still locks
> >
> > I am confident the problem exists on the exchange server seperate from the
> > exchange services.  The MS services that are running on the Exchange 2000
> > server are:
> >
> > alerter
> > computer browser
> > dist file system
> > dhcp cllient
> > logical disk mgr
> > dns client
> > event log
> > com+ event system
> > IIS admin
> > server
> > workstation
> > license logging service
> > tcp/ip netbios helper
> > messenger
> > distributed transaction coordinator
> > MS Exch information store
> > MS Exch system attendant
> > net logon
> > network connections
> > network news transport protocol
> > NT LM security support prov
> > plug n play
> > IPSEC policy agent
> > protected storage
> > remote registry
> > MS Exch routing engine
> > RPC locator
> > RPC
> > SAM
> > task scheduler
> > run as
> > system event
> > smtp
> > print spooler
> > term services
> > dist link tracking client
> > windows time
> > WWW publihing
> > windows mgt instrumentaion
> > windows mgt instrumentaion driver
> > automatic updates
> >
> > Of these which ones can I safely shut down w/o affecting exchange during
> > production.  I can then shut the others down after hours.
> >
> > Any suggestions would greatly appreciated as my next step may require
> > gasoline a match and a pack of hotdogs.
> >
> > Thanks in advance.
> > Cody 
> 
> 
>
0
CodyLewis (9)
7/21/2006 6:16:02 PM 
right...and have you changed your password lately?  if you have a persistent
connection to anything like Andy mentioned, and you recently changed your pw
and have not disconnected and re-connected, that could be the problem...

--
Susan Conkey [MVP]



"Andy David - MVP" <adavid@pleasekeepinngcheesebucket.com> wrote in message
news:uk52c2924a1i5agbpi6d3ekphqireegnv7@4ax.com...
> On Fri, 21 Jul 2006 10:57:02 -0700, Cody Lewis
> <CodyLewis@discussions.microsoft.com> wrote:
>
> >
> >
> >"Andy David - MVP" wrote:
> >
> >> On Fri, 21 Jul 2006 09:46:02 -0700, Cody Lewis
> >> <CodyLewis@discussions.microsoft.com> wrote:
> >>
> >> >My problem is my account locks out every 10 minutes.  (W2K domain)  No
other
> >> >account has a problem.  Over the past 3 days I have narrowed it down
to the
> >> >exchange server.
> >>
> >> What do you mean you narrowed it down to the Exch Server?
> >
> >Do these steps listed  not direct the problem to the exchange server?
> >Shut each DC down one at a time acct still locks.
> >Shut don exchange server account doesnt lock
> >Shut down exchange service acct still locks
> >I have also shut down all non MS services and the acct still locks
> > What do the security event logs say?
> >
> >Sorry should have included that
> >I get Event 539 Logon process ADVAPI logon type 3 followed by Event 681
> >Error code was 321225572, these errors repeat until acct is locked.  I
have
> >the policy set at 10 bad attempts until lockout.
>
> Right, but the security logs typically show the calling server (either
> one the server in question or on the DC the account gets locked on),
> so I am wondering why you went through all those steps.
> Logon type 3 is a network logon, so it could be logon to IIS, or a
> shared printer or mapped drive, etc///
>
> >
> >>
> >> >
> >> >Shut each DC down one at a time acct still locks.
> >> >Shut don exchange server account doesnt lock
> >> >Shut down exchange service acct still locks
> >> >I have also shut down all non MS services and the acct still locks
> >> >
> >> >I am confident the problem exists on the exchange server seperate from
the
> >> >exchange services.  The MS services that are running on the Exchange
2000
> >> >server are:
> >> >
> >> >alerter
> >> >computer browser
> >> >dist file system
> >> >dhcp cllient
> >> >logical disk mgr
> >> >dns client
> >> >event log
> >> >com+ event system
> >> >IIS admin
> >> >server
> >> >workstation
> >> >license logging service
> >> >tcp/ip netbios helper
> >> >messenger
> >> >distributed transaction coordinator
> >> >MS Exch information store
> >> >MS Exch system attendant
> >> >net logon
> >> >network connections
> >> >network news transport protocol
> >> >NT LM security support prov
> >> >plug n play
> >> >IPSEC policy agent
> >> >protected storage
> >> >remote registry
> >> >MS Exch routing engine
> >> >RPC locator
> >> >RPC
> >> >SAM
> >> >task scheduler
> >> >run as
> >> >system event
> >> >smtp
> >> >print spooler
> >> >term services
> >> >dist link tracking client
> >> >windows time
> >> >WWW publihing
> >> >windows mgt instrumentaion
> >> >windows mgt instrumentaion driver
> >> >automatic updates
> >> >
> >> >Of these which ones can I safely shut down w/o affecting exchange
during
> >> >production.  I can then shut the others down after hours.
> >> >
> >> >Any suggestions would greatly appreciated as my next step may require
> >> >gasoline a match and a pack of hotdogs.
> >> >
> >> >Thanks in advance.
> >> >Cody
> >>
0
sconkey (3059)
7/21/2006 6:16:57 PM 
It seemed like a logical progression of steps to go through.  I am up for 
suggestion at this point.  I diconnected all Mapped Drives, I dont have 
disconnected term serv sessions, I ddint look at shared printers I will look 
at that.  Do you think that the problem could exist on a different machine?

Thanks
Cody

"
> 
> Right, but the security logs typically show the calling server (either
> one the server in question or on the DC the account gets locked on),
> so I am wondering why you went through all those steps.
> Logon type 3 is a network logon, so it could be logon to IIS, or a
> shared printer or mapped drive, etc///
>
0
CodyLewis (9)
7/21/2006 6:20:01 PM 
I did change my password and that is the start of this issue.  How can I 
track down a persistant connection?  

"Susan" wrote:

> right...and have you changed your password lately?  if you have a persistent
> connection to anything like Andy mentioned, and you recently changed your pw
> and have not disconnected and re-connected, that could be the problem...
> 
> --
> Susan Conkey [MVP]
> 
> 
> 
> "Andy David - MVP" <adavid@pleasekeepinngcheesebucket.com> wrote in message
> news:uk52c2924a1i5agbpi6d3ekphqireegnv7@4ax.com...
> > On Fri, 21 Jul 2006 10:57:02 -0700, Cody Lewis
> > <CodyLewis@discussions.microsoft.com> wrote:
> >
> > >
> > >
> > >"Andy David - MVP" wrote:
> > >
> > >> On Fri, 21 Jul 2006 09:46:02 -0700, Cody Lewis
> > >> <CodyLewis@discussions.microsoft.com> wrote:
> > >>
> > >> >My problem is my account locks out every 10 minutes.  (W2K domain)  No
> other
> > >> >account has a problem.  Over the past 3 days I have narrowed it down
> to the
> > >> >exchange server.
> > >>
> > >> What do you mean you narrowed it down to the Exch Server?
> > >
> > >Do these steps listed  not direct the problem to the exchange server?
> > >Shut each DC down one at a time acct still locks.
> > >Shut don exchange server account doesnt lock
> > >Shut down exchange service acct still locks
> > >I have also shut down all non MS services and the acct still locks
> > > What do the security event logs say?
> > >
> > >Sorry should have included that
> > >I get Event 539 Logon process ADVAPI logon type 3 followed by Event 681
> > >Error code was 321225572, these errors repeat until acct is locked.  I
> have
> > >the policy set at 10 bad attempts until lockout.
> >
> > Right, but the security logs typically show the calling server (either
> > one the server in question or on the DC the account gets locked on),
> > so I am wondering why you went through all those steps.
> > Logon type 3 is a network logon, so it could be logon to IIS, or a
> > shared printer or mapped drive, etc///
> >
> > >
> > >>
> > >> >
> > >> >Shut each DC down one at a time acct still locks.
> > >> >Shut don exchange server account doesnt lock
> > >> >Shut down exchange service acct still locks
> > >> >I have also shut down all non MS services and the acct still locks
> > >> >
> > >> >I am confident the problem exists on the exchange server seperate from
> the
> > >> >exchange services.  The MS services that are running on the Exchange
> 2000
> > >> >server are:
> > >> >
> > >> >alerter
> > >> >computer browser
> > >> >dist file system
> > >> >dhcp cllient
> > >> >logical disk mgr
> > >> >dns client
> > >> >event log
> > >> >com+ event system
> > >> >IIS admin
> > >> >server
> > >> >workstation
> > >> >license logging service
> > >> >tcp/ip netbios helper
> > >> >messenger
> > >> >distributed transaction coordinator
> > >> >MS Exch information store
> > >> >MS Exch system attendant
> > >> >net logon
> > >> >network connections
> > >> >network news transport protocol
> > >> >NT LM security support prov
> > >> >plug n play
> > >> >IPSEC policy agent
> > >> >protected storage
> > >> >remote registry
> > >> >MS Exch routing engine
> > >> >RPC locator
> > >> >RPC
> > >> >SAM
> > >> >task scheduler
> > >> >run as
> > >> >system event
> > >> >smtp
> > >> >print spooler
> > >> >term services
> > >> >dist link tracking client
> > >> >windows time
> > >> >WWW publihing
> > >> >windows mgt instrumentaion
> > >> >windows mgt instrumentaion driver
> > >> >automatic updates
> > >> >
> > >> >Of these which ones can I safely shut down w/o affecting exchange
> during
> > >> >production.  I can then shut the others down after hours.
> > >> >
> > >> >Any suggestions would greatly appreciated as my next step may require
> > >> >gasoline a match and a pack of hotdogs.
> > >> >
> > >> >Thanks in advance.
> > >> >Cody
> > >>
> 
> 
>
0
CodyLewis (9)
7/21/2006 6:25:02 PM 
if you're connected to anything from a different machine, yes...

--
Susan Conkey [MVP]



"Cody Lewis" <CodyLewis@discussions.microsoft.com> wrote in message
news:7C2B7781-515E-4FCA-9764-44B3E2AEA3CC@microsoft.com...
> It seemed like a logical progression of steps to go through.  I am up for
> suggestion at this point.  I diconnected all Mapped Drives, I dont have
> disconnected term serv sessions, I ddint look at shared printers I will
look
> at that.  Do you think that the problem could exist on a different
machine?
>
> Thanks
> Cody
>
> "
> >
> > Right, but the security logs typically show the calling server (either
> > one the server in question or on the DC the account gets locked on),
> > so I am wondering why you went through all those steps.
> > Logon type 3 is a network logon, so it could be logon to IIS, or a
> > shared printer or mapped drive, etc///
> >
>
0
sconkey (3059)
7/21/2006 6:25:05 PM 
it's not easy...in the meantime, you might want to change your password back
to what it was, if your policies allow that, until you can track it
down...somewhere, your account is trying to access a network resource with
the old password...could be a connection to something, or some service
running somewhere trying to run under your account...are there any services
or functions failing somewhere?

--
Susan Conkey [MVP]



"Cody Lewis" <CodyLewis@discussions.microsoft.com> wrote in message
news:0209DFE7-3D6F-4213-B2D8-364487ED9E5A@microsoft.com...
> I did change my password and that is the start of this issue.  How can I
> track down a persistant connection?
>
> "Susan" wrote:
>
> > right...and have you changed your password lately?  if you have a
persistent
> > connection to anything like Andy mentioned, and you recently changed
your pw
> > and have not disconnected and re-connected, that could be the problem...
> >
> > --
> > Susan Conkey [MVP]
> >
> >
> >
> > "Andy David - MVP" <adavid@pleasekeepinngcheesebucket.com> wrote in
message
> > news:uk52c2924a1i5agbpi6d3ekphqireegnv7@4ax.com...
> > > On Fri, 21 Jul 2006 10:57:02 -0700, Cody Lewis
> > > <CodyLewis@discussions.microsoft.com> wrote:
> > >
> > > >
> > > >
> > > >"Andy David - MVP" wrote:
> > > >
> > > >> On Fri, 21 Jul 2006 09:46:02 -0700, Cody Lewis
> > > >> <CodyLewis@discussions.microsoft.com> wrote:
> > > >>
> > > >> >My problem is my account locks out every 10 minutes.  (W2K domain)
No
> > other
> > > >> >account has a problem.  Over the past 3 days I have narrowed it
down
> > to the
> > > >> >exchange server.
> > > >>
> > > >> What do you mean you narrowed it down to the Exch Server?
> > > >
> > > >Do these steps listed  not direct the problem to the exchange server?
> > > >Shut each DC down one at a time acct still locks.
> > > >Shut don exchange server account doesnt lock
> > > >Shut down exchange service acct still locks
> > > >I have also shut down all non MS services and the acct still locks
> > > > What do the security event logs say?
> > > >
> > > >Sorry should have included that
> > > >I get Event 539 Logon process ADVAPI logon type 3 followed by Event
681
> > > >Error code was 321225572, these errors repeat until acct is locked.
I
> > have
> > > >the policy set at 10 bad attempts until lockout.
> > >
> > > Right, but the security logs typically show the calling server (either
> > > one the server in question or on the DC the account gets locked on),
> > > so I am wondering why you went through all those steps.
> > > Logon type 3 is a network logon, so it could be logon to IIS, or a
> > > shared printer or mapped drive, etc///
> > >
> > > >
> > > >>
> > > >> >
> > > >> >Shut each DC down one at a time acct still locks.
> > > >> >Shut don exchange server account doesnt lock
> > > >> >Shut down exchange service acct still locks
> > > >> >I have also shut down all non MS services and the acct still locks
> > > >> >
> > > >> >I am confident the problem exists on the exchange server seperate
from
> > the
> > > >> >exchange services.  The MS services that are running on the
Exchange
> > 2000
> > > >> >server are:
> > > >> >
> > > >> >alerter
> > > >> >computer browser
> > > >> >dist file system
> > > >> >dhcp cllient
> > > >> >logical disk mgr
> > > >> >dns client
> > > >> >event log
> > > >> >com+ event system
> > > >> >IIS admin
> > > >> >server
> > > >> >workstation
> > > >> >license logging service
> > > >> >tcp/ip netbios helper
> > > >> >messenger
> > > >> >distributed transaction coordinator
> > > >> >MS Exch information store
> > > >> >MS Exch system attendant
> > > >> >net logon
> > > >> >network connections
> > > >> >network news transport protocol
> > > >> >NT LM security support prov
> > > >> >plug n play
> > > >> >IPSEC policy agent
> > > >> >protected storage
> > > >> >remote registry
> > > >> >MS Exch routing engine
> > > >> >RPC locator
> > > >> >RPC
> > > >> >SAM
> > > >> >task scheduler
> > > >> >run as
> > > >> >system event
> > > >> >smtp
> > > >> >print spooler
> > > >> >term services
> > > >> >dist link tracking client
> > > >> >windows time
> > > >> >WWW publihing
> > > >> >windows mgt instrumentaion
> > > >> >windows mgt instrumentaion driver
> > > >> >automatic updates
> > > >> >
> > > >> >Of these which ones can I safely shut down w/o affecting exchange
> > during
> > > >> >production.  I can then shut the others down after hours.
> > > >> >
> > > >> >Any suggestions would greatly appreciated as my next step may
require
> > > >> >gasoline a match and a pack of hotdogs.
> > > >> >
> > > >> >Thanks in advance.
> > > >> >Cody
> > > >>
> >
> >
> >
0
sconkey (3059)
7/21/2006 7:48:27 PM 
Susan that is an good idea, I just reset the password back the original, I 
will post back if it locks again.  As far as I can tell nothing is failing.  

The morning after I changed the password, I started modifying rights on a 
public folder, then i noticed the problem I dont know if it is connected at 
all.  

Thanks for your help
Cody

"Susan" wrote:

> it's not easy...in the meantime, you might want to change your password back
> to what it was, if your policies allow that, until you can track it
> down...somewhere, your account is trying to access a network resource with
> the old password...could be a connection to something, or some service
> running somewhere trying to run under your account...are there any services
> or functions failing somewhere?
> 
> --
> Susan Conkey [MVP]
> 
> 
> 
> "Cody Lewis" <CodyLewis@discussions.microsoft.com> wrote in message
> news:0209DFE7-3D6F-4213-B2D8-364487ED9E5A@microsoft.com...
> > I did change my password and that is the start of this issue.  How can I
> > track down a persistant connection?
> >
> > "Susan" wrote:
> >
> > > right...and have you changed your password lately?  if you have a
> persistent
> > > connection to anything like Andy mentioned, and you recently changed
> your pw
> > > and have not disconnected and re-connected, that could be the problem...
> > >
> > > --
> > > Susan Conkey [MVP]
> > >
> > >
> > >
> > > "Andy David - MVP" <adavid@pleasekeepinngcheesebucket.com> wrote in
> message
> > > news:uk52c2924a1i5agbpi6d3ekphqireegnv7@4ax.com...
> > > > On Fri, 21 Jul 2006 10:57:02 -0700, Cody Lewis
> > > > <CodyLewis@discussions.microsoft.com> wrote:
> > > >
> > > > >
> > > > >
> > > > >"Andy David - MVP" wrote:
> > > > >
> > > > >> On Fri, 21 Jul 2006 09:46:02 -0700, Cody Lewis
> > > > >> <CodyLewis@discussions.microsoft.com> wrote:
> > > > >>
> > > > >> >My problem is my account locks out every 10 minutes.  (W2K domain)
> No
> > > other
> > > > >> >account has a problem.  Over the past 3 days I have narrowed it
> down
> > > to the
> > > > >> >exchange server.
> > > > >>
> > > > >> What do you mean you narrowed it down to the Exch Server?
> > > > >
> > > > >Do these steps listed  not direct the problem to the exchange server?
> > > > >Shut each DC down one at a time acct still locks.
> > > > >Shut don exchange server account doesnt lock
> > > > >Shut down exchange service acct still locks
> > > > >I have also shut down all non MS services and the acct still locks
> > > > > What do the security event logs say?
> > > > >
> > > > >Sorry should have included that
> > > > >I get Event 539 Logon process ADVAPI logon type 3 followed by Event
> 681
> > > > >Error code was 321225572, these errors repeat until acct is locked.
> I
> > > have
> > > > >the policy set at 10 bad attempts until lockout.
> > > >
> > > > Right, but the security logs typically show the calling server (either
> > > > one the server in question or on the DC the account gets locked on),
> > > > so I am wondering why you went through all those steps.
> > > > Logon type 3 is a network logon, so it could be logon to IIS, or a
> > > > shared printer or mapped drive, etc///
> > > >
> > > > >
> > > > >>
> > > > >> >
> > > > >> >Shut each DC down one at a time acct still locks.
> > > > >> >Shut don exchange server account doesnt lock
> > > > >> >Shut down exchange service acct still locks
> > > > >> >I have also shut down all non MS services and the acct still locks
> > > > >> >
> > > > >> >I am confident the problem exists on the exchange server seperate
> from
> > > the
> > > > >> >exchange services.  The MS services that are running on the
> Exchange
> > > 2000
> > > > >> >server are:
> > > > >> >
> > > > >> >alerter
> > > > >> >computer browser
> > > > >> >dist file system
> > > > >> >dhcp cllient
> > > > >> >logical disk mgr
> > > > >> >dns client
> > > > >> >event log
> > > > >> >com+ event system
> > > > >> >IIS admin
> > > > >> >server
> > > > >> >workstation
> > > > >> >license logging service
> > > > >> >tcp/ip netbios helper
> > > > >> >messenger
> > > > >> >distributed transaction coordinator
> > > > >> >MS Exch information store
> > > > >> >MS Exch system attendant
> > > > >> >net logon
> > > > >> >network connections
> > > > >> >network news transport protocol
> > > > >> >NT LM security support prov
> > > > >> >plug n play
> > > > >> >IPSEC policy agent
> > > > >> >protected storage
> > > > >> >remote registry
> > > > >> >MS Exch routing engine
> > > > >> >RPC locator
> > > > >> >RPC
> > > > >> >SAM
> > > > >> >task scheduler
> > > > >> >run as
> > > > >> >system event
> > > > >> >smtp
> > > > >> >print spooler
> > > > >> >term services
> > > > >> >dist link tracking client
> > > > >> >windows time
> > > > >> >WWW publihing
> > > > >> >windows mgt instrumentaion
> > > > >> >windows mgt instrumentaion driver
> > > > >> >automatic updates
> > > > >> >
> > > > >> >Of these which ones can I safely shut down w/o affecting exchange
> > > during
> > > > >> >production.  I can then shut the others down after hours.
> > > > >> >
> > > > >> >Any suggestions would greatly appreciated as my next step may
> require
> > > > >> >gasoline a match and a pack of hotdogs.
> > > > >> >
> > > > >> >Thanks in advance.
> > > > >> >Cody
> > > > >>
> > >
> > >
> > >
> 
> 
>
0
CodyLewis (9)
7/21/2006 8:04:01 PM 
Don't forget to check things like scheduled tasks.

You might also check into downloading and running Process Explorer from 
Sysinternals - you can add a column to see which processes are running as 
which user.

-- 
Ben Winzenz
Exchange MVP
MessageOne
Read my blog!
http://winzenz.blogspot.com
http://feeds.feedburner.com/winzenz (RSS Feed)


"Cody Lewis" <CodyLewis@discussions.microsoft.com> wrote in message 
news:A0E31A87-9A5C-4CF0-8E50-302F0081D4BA@microsoft.com...
> Susan that is an good idea, I just reset the password back the original, I
> will post back if it locks again.  As far as I can tell nothing is 
> failing.
>
> The morning after I changed the password, I started modifying rights on a
> public folder, then i noticed the problem I dont know if it is connected 
> at
> all.
>
> Thanks for your help
> Cody
>
> "Susan" wrote:
>
>> it's not easy...in the meantime, you might want to change your password 
>> back
>> to what it was, if your policies allow that, until you can track it
>> down...somewhere, your account is trying to access a network resource 
>> with
>> the old password...could be a connection to something, or some service
>> running somewhere trying to run under your account...are there any 
>> services
>> or functions failing somewhere?
>>
>> --
>> Susan Conkey [MVP]
>>
>>
>>
>> "Cody Lewis" <CodyLewis@discussions.microsoft.com> wrote in message
>> news:0209DFE7-3D6F-4213-B2D8-364487ED9E5A@microsoft.com...
>> > I did change my password and that is the start of this issue.  How can 
>> > I
>> > track down a persistant connection?
>> >
>> > "Susan" wrote:
>> >
>> > > right...and have you changed your password lately?  if you have a
>> persistent
>> > > connection to anything like Andy mentioned, and you recently changed
>> your pw
>> > > and have not disconnected and re-connected, that could be the 
>> > > problem...
>> > >
>> > > --
>> > > Susan Conkey [MVP]
>> > >
>> > >
>> > >
>> > > "Andy David - MVP" <adavid@pleasekeepinngcheesebucket.com> wrote in
>> message
>> > > news:uk52c2924a1i5agbpi6d3ekphqireegnv7@4ax.com...
>> > > > On Fri, 21 Jul 2006 10:57:02 -0700, Cody Lewis
>> > > > <CodyLewis@discussions.microsoft.com> wrote:
>> > > >
>> > > > >
>> > > > >
>> > > > >"Andy David - MVP" wrote:
>> > > > >
>> > > > >> On Fri, 21 Jul 2006 09:46:02 -0700, Cody Lewis
>> > > > >> <CodyLewis@discussions.microsoft.com> wrote:
>> > > > >>
>> > > > >> >My problem is my account locks out every 10 minutes.  (W2K 
>> > > > >> >domain)
>> No
>> > > other
>> > > > >> >account has a problem.  Over the past 3 days I have narrowed it
>> down
>> > > to the
>> > > > >> >exchange server.
>> > > > >>
>> > > > >> What do you mean you narrowed it down to the Exch Server?
>> > > > >
>> > > > >Do these steps listed  not direct the problem to the exchange 
>> > > > >server?
>> > > > >Shut each DC down one at a time acct still locks.
>> > > > >Shut don exchange server account doesnt lock
>> > > > >Shut down exchange service acct still locks
>> > > > >I have also shut down all non MS services and the acct still locks
>> > > > > What do the security event logs say?
>> > > > >
>> > > > >Sorry should have included that
>> > > > >I get Event 539 Logon process ADVAPI logon type 3 followed by 
>> > > > >Event
>> 681
>> > > > >Error code was 321225572, these errors repeat until acct is 
>> > > > >locked.
>> I
>> > > have
>> > > > >the policy set at 10 bad attempts until lockout.
>> > > >
>> > > > Right, but the security logs typically show the calling server 
>> > > > (either
>> > > > one the server in question or on the DC the account gets locked 
>> > > > on),
>> > > > so I am wondering why you went through all those steps.
>> > > > Logon type 3 is a network logon, so it could be logon to IIS, or a
>> > > > shared printer or mapped drive, etc///
>> > > >
>> > > > >
>> > > > >>
>> > > > >> >
>> > > > >> >Shut each DC down one at a time acct still locks.
>> > > > >> >Shut don exchange server account doesnt lock
>> > > > >> >Shut down exchange service acct still locks
>> > > > >> >I have also shut down all non MS services and the acct still 
>> > > > >> >locks
>> > > > >> >
>> > > > >> >I am confident the problem exists on the exchange server 
>> > > > >> >seperate
>> from
>> > > the
>> > > > >> >exchange services.  The MS services that are running on the
>> Exchange
>> > > 2000
>> > > > >> >server are:
>> > > > >> >
>> > > > >> >alerter
>> > > > >> >computer browser
>> > > > >> >dist file system
>> > > > >> >dhcp cllient
>> > > > >> >logical disk mgr
>> > > > >> >dns client
>> > > > >> >event log
>> > > > >> >com+ event system
>> > > > >> >IIS admin
>> > > > >> >server
>> > > > >> >workstation
>> > > > >> >license logging service
>> > > > >> >tcp/ip netbios helper
>> > > > >> >messenger
>> > > > >> >distributed transaction coordinator
>> > > > >> >MS Exch information store
>> > > > >> >MS Exch system attendant
>> > > > >> >net logon
>> > > > >> >network connections
>> > > > >> >network news transport protocol
>> > > > >> >NT LM security support prov
>> > > > >> >plug n play
>> > > > >> >IPSEC policy agent
>> > > > >> >protected storage
>> > > > >> >remote registry
>> > > > >> >MS Exch routing engine
>> > > > >> >RPC locator
>> > > > >> >RPC
>> > > > >> >SAM
>> > > > >> >task scheduler
>> > > > >> >run as
>> > > > >> >system event
>> > > > >> >smtp
>> > > > >> >print spooler
>> > > > >> >term services
>> > > > >> >dist link tracking client
>> > > > >> >windows time
>> > > > >> >WWW publihing
>> > > > >> >windows mgt instrumentaion
>> > > > >> >windows mgt instrumentaion driver
>> > > > >> >automatic updates
>> > > > >> >
>> > > > >> >Of these which ones can I safely shut down w/o affecting 
>> > > > >> >exchange
>> > > during
>> > > > >> >production.  I can then shut the others down after hours.
>> > > > >> >
>> > > > >> >Any suggestions would greatly appreciated as my next step may
>> require
>> > > > >> >gasoline a match and a pack of hotdogs.
>> > > > >> >
>> > > > >> >Thanks in advance.
>> > > > >> >Cody
>> > > > >>
>> > >
>> > >
>> > >
>>
>>
>>
0
Ben
7/21/2006 8:29:58 PM 
Thanks Ben I will try that

Cody

"Ben Winzenz [Exchange MVP]" wrote:

> Don't forget to check things like scheduled tasks.
> 
> You might also check into downloading and running Process Explorer from 
> Sysinternals - you can add a column to see which processes are running as 
> which user.
> 
> -- 
> Ben Winzenz
> Exchange MVP
> MessageOne
> Read my blog!
> http://winzenz.blogspot.com
> http://feeds.feedburner.com/winzenz (RSS Feed)
> 
> 
> "Cody Lewis" <CodyLewis@discussions.microsoft.com> wrote in message 
> news:A0E31A87-9A5C-4CF0-8E50-302F0081D4BA@microsoft.com...
> > Susan that is an good idea, I just reset the password back the original, I
> > will post back if it locks again.  As far as I can tell nothing is 
> > failing.
> >
> > The morning after I changed the password, I started modifying rights on a
> > public folder, then i noticed the problem I dont know if it is connected 
> > at
> > all.
> >
> > Thanks for your help
> > Cody
> >
> > "Susan" wrote:
> >
> >> it's not easy...in the meantime, you might want to change your password 
> >> back
> >> to what it was, if your policies allow that, until you can track it
> >> down...somewhere, your account is trying to access a network resource 
> >> with
> >> the old password...could be a connection to something, or some service
> >> running somewhere trying to run under your account...are there any 
> >> services
> >> or functions failing somewhere?
> >>
> >> --
> >> Susan Conkey [MVP]
> >>
> >>
> >>
> >> "Cody Lewis" <CodyLewis@discussions.microsoft.com> wrote in message
> >> news:0209DFE7-3D6F-4213-B2D8-364487ED9E5A@microsoft.com...
> >> > I did change my password and that is the start of this issue.  How can 
> >> > I
> >> > track down a persistant connection?
> >> >
> >> > "Susan" wrote:
> >> >
> >> > > right...and have you changed your password lately?  if you have a
> >> persistent
> >> > > connection to anything like Andy mentioned, and you recently changed
> >> your pw
> >> > > and have not disconnected and re-connected, that could be the 
> >> > > problem...
> >> > >
> >> > > --
> >> > > Susan Conkey [MVP]
> >> > >
> >> > >
> >> > >
> >> > > "Andy David - MVP" <adavid@pleasekeepinngcheesebucket.com> wrote in
> >> message
> >> > > news:uk52c2924a1i5agbpi6d3ekphqireegnv7@4ax.com...
> >> > > > On Fri, 21 Jul 2006 10:57:02 -0700, Cody Lewis
> >> > > > <CodyLewis@discussions.microsoft.com> wrote:
> >> > > >
> >> > > > >
> >> > > > >
> >> > > > >"Andy David - MVP" wrote:
> >> > > > >
> >> > > > >> On Fri, 21 Jul 2006 09:46:02 -0700, Cody Lewis
> >> > > > >> <CodyLewis@discussions.microsoft.com> wrote:
> >> > > > >>
> >> > > > >> >My problem is my account locks out every 10 minutes.  (W2K 
> >> > > > >> >domain)
> >> No
> >> > > other
> >> > > > >> >account has a problem.  Over the past 3 days I have narrowed it
> >> down
> >> > > to the
> >> > > > >> >exchange server.
> >> > > > >>
> >> > > > >> What do you mean you narrowed it down to the Exch Server?
> >> > > > >
> >> > > > >Do these steps listed  not direct the problem to the exchange 
> >> > > > >server?
> >> > > > >Shut each DC down one at a time acct still locks.
> >> > > > >Shut don exchange server account doesnt lock
> >> > > > >Shut down exchange service acct still locks
> >> > > > >I have also shut down all non MS services and the acct still locks
> >> > > > > What do the security event logs say?
> >> > > > >
> >> > > > >Sorry should have included that
> >> > > > >I get Event 539 Logon process ADVAPI logon type 3 followed by 
> >> > > > >Event
> >> 681
> >> > > > >Error code was 321225572, these errors repeat until acct is 
> >> > > > >locked.
> >> I
> >> > > have
> >> > > > >the policy set at 10 bad attempts until lockout.
> >> > > >
> >> > > > Right, but the security logs typically show the calling server 
> >> > > > (either
> >> > > > one the server in question or on the DC the account gets locked 
> >> > > > on),
> >> > > > so I am wondering why you went through all those steps.
> >> > > > Logon type 3 is a network logon, so it could be logon to IIS, or a
> >> > > > shared printer or mapped drive, etc///
> >> > > >
> >> > > > >
> >> > > > >>
> >> > > > >> >
> >> > > > >> >Shut each DC down one at a time acct still locks.
> >> > > > >> >Shut don exchange server account doesnt lock
> >> > > > >> >Shut down exchange service acct still locks
> >> > > > >> >I have also shut down all non MS services and the acct still 
> >> > > > >> >locks
> >> > > > >> >
> >> > > > >> >I am confident the problem exists on the exchange server 
> >> > > > >> >seperate
> >> from
> >> > > the
> >> > > > >> >exchange services.  The MS services that are running on the
> >> Exchange
> >> > > 2000
> >> > > > >> >server are:
> >> > > > >> >
> >> > > > >> >alerter
> >> > > > >> >computer browser
> >> > > > >> >dist file system
> >> > > > >> >dhcp cllient
> >> > > > >> >logical disk mgr
> >> > > > >> >dns client
> >> > > > >> >event log
> >> > > > >> >com+ event system
> >> > > > >> >IIS admin
> >> > > > >> >server
> >> > > > >> >workstation
> >> > > > >> >license logging service
> >> > > > >> >tcp/ip netbios helper
> >> > > > >> >messenger
> >> > > > >> >distributed transaction coordinator
> >> > > > >> >MS Exch information store
> >> > > > >> >MS Exch system attendant
> >> > > > >> >net logon
> >> > > > >> >network connections
> >> > > > >> >network news transport protocol
> >> > > > >> >NT LM security support prov
> >> > > > >> >plug n play
> >> > > > >> >IPSEC policy agent
> >> > > > >> >protected storage
> >> > > > >> >remote registry
> >> > > > >> >MS Exch routing engine
> >> > > > >> >RPC locator
> >> > > > >> >RPC
> >> > > > >> >SAM
> >> > > > >> >task scheduler
> >> > > > >> >run as
> >> > > > >> >system event
> >> > > > >> >smtp
> >> > > > >> >print spooler
> >> > > > >> >term services
> >> > > > >> >dist link tracking client
> >> > > > >> >windows time
> >> > > > >> >WWW publihing
> >> > > > >> >windows mgt instrumentaion
> >> > > > >> >windows mgt instrumentaion driver
> >> > > > >> >automatic updates
> >> > > > >> >
> >> > > > >> >Of these which ones can I safely shut down w/o affecting 
> >> > > > >> >exchange
> >> > > during
> >> > > > >> >production.  I can then shut the others down after hours.
> >> > > > >> >
> >> > > > >> >Any suggestions would greatly appreciated as my next step may
> >> require
> >> > > > >> >gasoline a match and a pack of hotdogs.
> >> > > > >> >
> >> > > > >> >Thanks in advance.
> >> > > > >> >Cody
> >> > > > >>
> >> > >
> >> > >
> >> > >
> >>
> >>
> >> 
> 
> 
>
0
CodyLewis (9)
7/21/2006 8:50:02 PM 
Hi Susan, The acct locked again.  I went back two passwords no luck.  

Thanks

"Susan" wrote:

> it's not easy...in the meantime, you might want to change your password back
> to what it was, if your policies allow that, until you can track it
> down...somewhere, your account is trying to access a network resource with
> the old password...could be a connection to something, or some service
> running somewhere trying to run under your account...are there any services
> or functions failing somewhere?
> 
> --
> Susan Conkey [MVP]
> 
> 
> 
> "Cody Lewis" <CodyLewis@discussions.microsoft.com> wrote in message
> news:0209DFE7-3D6F-4213-B2D8-364487ED9E5A@microsoft.com...
> > I did change my password and that is the start of this issue.  How can I
> > track down a persistant connection?
> >
> > "Susan" wrote:
> >
> > > right...and have you changed your password lately?  if you have a
> persistent
> > > connection to anything like Andy mentioned, and you recently changed
> your pw
> > > and have not disconnected and re-connected, that could be the problem...
> > >
> > > --
> > > Susan Conkey [MVP]
> > >
> > >
> > >
> > > "Andy David - MVP" <adavid@pleasekeepinngcheesebucket.com> wrote in
> message
> > > news:uk52c2924a1i5agbpi6d3ekphqireegnv7@4ax.com...
> > > > On Fri, 21 Jul 2006 10:57:02 -0700, Cody Lewis
> > > > <CodyLewis@discussions.microsoft.com> wrote:
> > > >
> > > > >
> > > > >
> > > > >"Andy David - MVP" wrote:
> > > > >
> > > > >> On Fri, 21 Jul 2006 09:46:02 -0700, Cody Lewis
> > > > >> <CodyLewis@discussions.microsoft.com> wrote:
> > > > >>
> > > > >> >My problem is my account locks out every 10 minutes.  (W2K domain)
> No
> > > other
> > > > >> >account has a problem.  Over the past 3 days I have narrowed it
> down
> > > to the
> > > > >> >exchange server.
> > > > >>
> > > > >> What do you mean you narrowed it down to the Exch Server?
> > > > >
> > > > >Do these steps listed  not direct the problem to the exchange server?
> > > > >Shut each DC down one at a time acct still locks.
> > > > >Shut don exchange server account doesnt lock
> > > > >Shut down exchange service acct still locks
> > > > >I have also shut down all non MS services and the acct still locks
> > > > > What do the security event logs say?
> > > > >
> > > > >Sorry should have included that
> > > > >I get Event 539 Logon process ADVAPI logon type 3 followed by Event
> 681
> > > > >Error code was 321225572, these errors repeat until acct is locked.
> I
> > > have
> > > > >the policy set at 10 bad attempts until lockout.
> > > >
> > > > Right, but the security logs typically show the calling server (either
> > > > one the server in question or on the DC the account gets locked on),
> > > > so I am wondering why you went through all those steps.
> > > > Logon type 3 is a network logon, so it could be logon to IIS, or a
> > > > shared printer or mapped drive, etc///
> > > >
> > > > >
> > > > >>
> > > > >> >
> > > > >> >Shut each DC down one at a time acct still locks.
> > > > >> >Shut don exchange server account doesnt lock
> > > > >> >Shut down exchange service acct still locks
> > > > >> >I have also shut down all non MS services and the acct still locks
> > > > >> >
> > > > >> >I am confident the problem exists on the exchange server seperate
> from
> > > the
> > > > >> >exchange services.  The MS services that are running on the
> Exchange
> > > 2000
> > > > >> >server are:
> > > > >> >
> > > > >> >alerter
> > > > >> >computer browser
> > > > >> >dist file system
> > > > >> >dhcp cllient
> > > > >> >logical disk mgr
> > > > >> >dns client
> > > > >> >event log
> > > > >> >com+ event system
> > > > >> >IIS admin
> > > > >> >server
> > > > >> >workstation
> > > > >> >license logging service
> > > > >> >tcp/ip netbios helper
> > > > >> >messenger
> > > > >> >distributed transaction coordinator
> > > > >> >MS Exch information store
> > > > >> >MS Exch system attendant
> > > > >> >net logon
> > > > >> >network connections
> > > > >> >network news transport protocol
> > > > >> >NT LM security support prov
> > > > >> >plug n play
> > > > >> >IPSEC policy agent
> > > > >> >protected storage
> > > > >> >remote registry
> > > > >> >MS Exch routing engine
> > > > >> >RPC locator
> > > > >> >RPC
> > > > >> >SAM
> > > > >> >task scheduler
> > > > >> >run as
> > > > >> >system event
> > > > >> >smtp
> > > > >> >print spooler
> > > > >> >term services
> > > > >> >dist link tracking client
> > > > >> >windows time
> > > > >> >WWW publihing
> > > > >> >windows mgt instrumentaion
> > > > >> >windows mgt instrumentaion driver
> > > > >> >automatic updates
> > > > >> >
> > > > >> >Of these which ones can I safely shut down w/o affecting exchange
> > > during
> > > > >> >production.  I can then shut the others down after hours.
> > > > >> >
> > > > >> >Any suggestions would greatly appreciated as my next step may
> require
> > > > >> >gasoline a match and a pack of hotdogs.
> > > > >> >
> > > > >> >Thanks in advance.
> > > > >> >Cody
> > > > >>
> > >
> > >
> > >
> 
> 
>
0
CodyLewis (9)
7/21/2006 8:51:01 PM 
The services all ran under the domain admin acct.  

Thanks

"Ben Winzenz [Exchange MVP]" wrote:

> Don't forget to check things like scheduled tasks.
> 
> You might also check into downloading and running Process Explorer from 
> Sysinternals - you can add a column to see which processes are running as 
> which user.
> 
> -- 
> Ben Winzenz
> Exchange MVP
> MessageOne
> Read my blog!
> http://winzenz.blogspot.com
> http://feeds.feedburner.com/winzenz (RSS Feed)
> 
> 
> "Cody Lewis" <CodyLewis@discussions.microsoft.com> wrote in message 
> news:A0E31A87-9A5C-4CF0-8E50-302F0081D4BA@microsoft.com...
> > Susan that is an good idea, I just reset the password back the original, I
> > will post back if it locks again.  As far as I can tell nothing is 
> > failing.
> >
> > The morning after I changed the password, I started modifying rights on a
> > public folder, then i noticed the problem I dont know if it is connected 
> > at
> > all.
> >
> > Thanks for your help
> > Cody
> >
> > "Susan" wrote:
> >
> >> it's not easy...in the meantime, you might want to change your password 
> >> back
> >> to what it was, if your policies allow that, until you can track it
> >> down...somewhere, your account is trying to access a network resource 
> >> with
> >> the old password...could be a connection to something, or some service
> >> running somewhere trying to run under your account...are there any 
> >> services
> >> or functions failing somewhere?
> >>
> >> --
> >> Susan Conkey [MVP]
> >>
> >>
> >>
> >> "Cody Lewis" <CodyLewis@discussions.microsoft.com> wrote in message
> >> news:0209DFE7-3D6F-4213-B2D8-364487ED9E5A@microsoft.com...
> >> > I did change my password and that is the start of this issue.  How can 
> >> > I
> >> > track down a persistant connection?
> >> >
> >> > "Susan" wrote:
> >> >
> >> > > right...and have you changed your password lately?  if you have a
> >> persistent
> >> > > connection to anything like Andy mentioned, and you recently changed
> >> your pw
> >> > > and have not disconnected and re-connected, that could be the 
> >> > > problem...
> >> > >
> >> > > --
> >> > > Susan Conkey [MVP]
> >> > >
> >> > >
> >> > >
> >> > > "Andy David - MVP" <adavid@pleasekeepinngcheesebucket.com> wrote in
> >> message
> >> > > news:uk52c2924a1i5agbpi6d3ekphqireegnv7@4ax.com...
> >> > > > On Fri, 21 Jul 2006 10:57:02 -0700, Cody Lewis
> >> > > > <CodyLewis@discussions.microsoft.com> wrote:
> >> > > >
> >> > > > >
> >> > > > >
> >> > > > >"Andy David - MVP" wrote:
> >> > > > >
> >> > > > >> On Fri, 21 Jul 2006 09:46:02 -0700, Cody Lewis
> >> > > > >> <CodyLewis@discussions.microsoft.com> wrote:
> >> > > > >>
> >> > > > >> >My problem is my account locks out every 10 minutes.  (W2K 
> >> > > > >> >domain)
> >> No
> >> > > other
> >> > > > >> >account has a problem.  Over the past 3 days I have narrowed it
> >> down
> >> > > to the
> >> > > > >> >exchange server.
> >> > > > >>
> >> > > > >> What do you mean you narrowed it down to the Exch Server?
> >> > > > >
> >> > > > >Do these steps listed  not direct the problem to the exchange 
> >> > > > >server?
> >> > > > >Shut each DC down one at a time acct still locks.
> >> > > > >Shut don exchange server account doesnt lock
> >> > > > >Shut down exchange service acct still locks
> >> > > > >I have also shut down all non MS services and the acct still locks
> >> > > > > What do the security event logs say?
> >> > > > >
> >> > > > >Sorry should have included that
> >> > > > >I get Event 539 Logon process ADVAPI logon type 3 followed by 
> >> > > > >Event
> >> 681
> >> > > > >Error code was 321225572, these errors repeat until acct is 
> >> > > > >locked.
> >> I
> >> > > have
> >> > > > >the policy set at 10 bad attempts until lockout.
> >> > > >
> >> > > > Right, but the security logs typically show the calling server 
> >> > > > (either
> >> > > > one the server in question or on the DC the account gets locked 
> >> > > > on),
> >> > > > so I am wondering why you went through all those steps.
> >> > > > Logon type 3 is a network logon, so it could be logon to IIS, or a
> >> > > > shared printer or mapped drive, etc///
> >> > > >
> >> > > > >
> >> > > > >>
> >> > > > >> >
> >> > > > >> >Shut each DC down one at a time acct still locks.
> >> > > > >> >Shut don exchange server account doesnt lock
> >> > > > >> >Shut down exchange service acct still locks
> >> > > > >> >I have also shut down all non MS services and the acct still 
> >> > > > >> >locks
> >> > > > >> >
> >> > > > >> >I am confident the problem exists on the exchange server 
> >> > > > >> >seperate
> >> from
> >> > > the
> >> > > > >> >exchange services.  The MS services that are running on the
> >> Exchange
> >> > > 2000
> >> > > > >> >server are:
> >> > > > >> >
> >> > > > >> >alerter
> >> > > > >> >computer browser
> >> > > > >> >dist file system
> >> > > > >> >dhcp cllient
> >> > > > >> >logical disk mgr
> >> > > > >> >dns client
> >> > > > >> >event log
> >> > > > >> >com+ event system
> >> > > > >> >IIS admin
> >> > > > >> >server
> >> > > > >> >workstation
> >> > > > >> >license logging service
> >> > > > >> >tcp/ip netbios helper
> >> > > > >> >messenger
> >> > > > >> >distributed transaction coordinator
> >> > > > >> >MS Exch information store
> >> > > > >> >MS Exch system attendant
> >> > > > >> >net logon
> >> > > > >> >network connections
> >> > > > >> >network news transport protocol
> >> > > > >> >NT LM security support prov
> >> > > > >> >plug n play
> >> > > > >> >IPSEC policy agent
> >> > > > >> >protected storage
> >> > > > >> >remote registry
> >> > > > >> >MS Exch routing engine
> >> > > > >> >RPC locator
> >> > > > >> >RPC
> >> > > > >> >SAM
> >> > > > >> >task scheduler
> >> > > > >> >run as
> >> > > > >> >system event
> >> > > > >> >smtp
> >> > > > >> >print spooler
> >> > > > >> >term services
> >> > > > >> >dist link tracking client
> >> > > > >> >windows time
> >> > > > >> >WWW publihing
> >> > > > >> >windows mgt instrumentaion
> >> > > > >> >windows mgt instrumentaion driver
> >> > > > >> >automatic updates
> >> > > > >> >
> >> > > > >> >Of these which ones can I safely shut down w/o affecting 
> >> > > > >> >exchange
> >> > > during
> >> > > > >> >production.  I can then shut the others down after hours.
> >> > > > >> >
> >> > > > >> >Any suggestions would greatly appreciated as my next step may
> >> require
> >> > > > >> >gasoline a match and a pack of hotdogs.
> >> > > > >> >
> >> > > > >> >Thanks in advance.
> >> > > > >> >Cody
> >> > > > >>
> >> > >
> >> > >
> >> > >
> >>
> >>
> >> 
> 
> 
>
0
CodyLewis (9)
7/21/2006 9:39:02 PM
Reply:

Similar Artilces:

setting up outlook 2003 connection to exchange server 2003
Hi my desktop disks crashed 7 months ago and I have been using my laptop (win 2k pro sp4 and outlook 2003 with vpn) for this time SUCCESSFULLY. I built a new desktop using win 2k SERVER (for the raid-mirror function). I am using the SAME settings to configure the outlook 2003 client in BOTH cases (hosts file in same location as in win2k pro, email account name, server name and vpn settings, authentication). in the article Q155048 the suggestion is made to ping the server, oddly enough I CANNOT ping microsoft.com nor the outsourced exchange server (time out), when the vpn is runni...

Formula help... #3
In column A there are cells with team names in them like the following: NYY NYY NYY @OAK @OAK @OAK BOS BOS BOS @TEX @TEX @TEX I would like column B to list all the team names without the @ symbol and column H to list all the teams with the @ symbol. For the example I would like column B to have NYY NYY NYY BOS BOS BOS =COUNTIF(A:A,"@*") and =COUNTIF(A:A,"<>@*") -- HTH RP (remove nothere from the email address if mailing direct) "Jambruins" <Jambruins@discussions.microsoft.com> wrote in message news:135965C4-7523-47AB-88DE-D0B12B652CD5@m...

Need help ASAP!!
I've just been on the already installed version of windows mail on my laptop and i already have an email address and can't get it onto the windows mail. It only gives you the option of a new account. Please reply!! -- Im a cod fan haha lol If you have never set up your email account in that copy of Windows Mail, then as far as Windows Mail is concerned, it is a new account. Simply follow the prompts after going to Tools, Accounts, Add, E-mail... Gary VanderMolen, Microsoft MVP (Mail) "STaTiC_BLuE" wrote in message news:B5201BC2-0822-4456-B08B-86787DD8D736@...

Word Attachment problem
Have a network of PC's with MS Office of various flavours, drawing Email from Exchange Server. On one PC, have had an ongoing problem with Word attachments. PC has ben reformatted, permissions opened up to Admin, Office upgraded, from 2000 through XP to 2003 all with the same result. When you double click on a Word attachment and chosse to open it, you get a 'Serious error' report with the option to restart Word. Sometimes this works other times it just loops through the same. The latest update to Office 2003, when using the 'Send Report' and then using the diagnosis fro...

How do i get outlook to update hotmail account without reopening?
the tedster <the tedster@discussions.microsoft.com> wrote: <nothing> Ask your question in the body of the message. Without reopening what? Outlook? Hotmail? The short answer is "you can't". -- Brian Tillman ...

Outlook Mobile Access Problem
Hi I've a big problem in Outlook Mobile Access. I've a server exchange standalone withoput a front-end=20 one... I've configured the OWA web form authentication and SSL. For OWA it's all right...everything is going right... The problem is OMA When I try to log on on oma I find the following error=20 message :"Unable to connect to your mailbox" To solve my problem I've found in microsoft web site the=20 following link Microsoft Knowledge Base - 817379 Cannot Access Exchange Server 2003 by Using Outlook Mobile=20 Access When the Exchange Virtual Directory Require...

problem with signature
I am trying to create a simple signature for my HTML mails, with a link to my website.I want it to be a hover link, no underline. I have made a very simple HTML in Dreamweaver, and all the appropriate attributes and styles are set via CSS. It looks and works fine on my browser. But when I select it as my signature file in OL2003, hover link property disappears and it reverts to the dreaded underline link. Any ideas how achieve this? TIA ...

Outlook2k7 over VPN Out of Office Assistant problem
User's computer is not a member of the domain. Mail flows and all looks good till you start the OOF thing. It will just tell you it cannot connect to the server because it's currently unavailable. Now when we add autodiscover.domain.com pointing to the Exchange server to the host file of that computer it works but why? Without it when you run a test it will tell you that a Srv Record lookup for domain.com FAILED (0x8004010F) or Local autodiscover for domain.com FAILED (0x8004010F) yaro Hello yaro, Thanks for your post. The error 0x8004010F usually means MAPI_E_NOT_FOU...

Lock and Unlock Splitters
Hai Iam looking to UnLock the SplitterWindow and based on some action i need to lock the splitter window and please let me know how to do it mike Deived a CSplitterWnd derived class and handle both WM_SETCURSOR, WM_LBUTTONDOWN and WM_LBUTTONUP. If your app is in locked-splitter state (you can use a bool variable to implement this), do not call the base class implementations, instead call the CWnd implementations. -- Regards, Nish [VC++ MVP] http://www.voidnish.com http://blog.voidnish.com "Mike...

MSN accounts dosen't work in Outlook.
Hi! I can't download my e-mails from MSN to Microsoft Outlook 2003. I have setup the account correspondent to Microsoft Outlook 2003 Wizard, but it still dosen't work. Does anyone know where the problem can be? Thanks, Bob Only the paid MSN and Hotmail accounts will work in Outlook and/or Outlook Express. Are you supscribed to the paid service? -- Robert Sparnaaij [MVP-Outlook] www.howto-outlook.com Tips of the month: -What do the Outlook Icons Mean? -Create an Office 2003 CD slipstreamed with Service Pack 1 ----- "hardharut" <test111@test.com> wrote in me...

outlook 2000 help file
Seems after I did added SP3 from MS upgrade site my help from outlook has quit working. message is msohelp caused error in itss.dll. help works in ALL other programs including outlook address book. I'm running windows 98 SE, Office 2000 SB and IE 6. --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.542 / Virus Database: 336 - Release Date: 11/18/03 ...

Analytical Accounting #6
I am trying to find a way to do more detailed reporting from the General Ledger. Your GL is only as strong as the number of segments and the number of ways you can slice and dice the data based on the combination of segments. We have over 40,000 accounts in our GL and that is not enough. I have not read through the PDF on Analytical Accounting yet. Could somebody briefly explain what Analytical Accounting does. Nutshell version: you can create codes (and groupings of codes), and assign them to account numbers. For example, you could have one account that tracks all Grant Money receive...

Exchange 2007 Evaluation version #2
Can I install it on 64 bit platform and run it as production? On Fri, 23 Feb 2007 09:55:13 -0800, RG <RG@discussions.microsoft.com> wrote: >Can I install it on 64 bit platform and run it as production? There isn't an evaluation version as such. You can install Exchange 2007 without a key for 120 days. ...

Moving 5.5 server from one domain to another
Ex 5.5, sp4 on Win2000 sp4, Mcafee VScan8, Veritas 8.6 currently in NT4 domain. Have exactly the same config in another office except this Ex 5.5 server is the bridge end. Have gone through the process of changing service accounts and that is working fine and machine is using the new service accounts to run the services, (ie using the new service account in the Windows 2003 domain), when I drop out of "abc" domain and into "xyz" domain machine comes up fine, all services start but after about 60 secs the information store stops, if I try to start it manually I get er...

How to download into investment account?
Trying to download from the Charles Schwab & Co into my investment account. Just recently converted from Quicken to Money 2004 and then i am having issues with downloading from Charles Schwab. When i download from the FI i get transactions dating back to August which is there in the register already. Now when i make that void i cannot delete this and this is not going from the 'Review transactions' list after i download. Now tried to setup online services with a new file and when downloading have new issuew. The date range is for the past month but the cash account is gr...

Edit Microsoft Exchange System Object with ADSI
When I applied a new recipient policy to add a 2nd domain name to our users, I applied it to all rather than using a filter to only pick the users in the Users OU. Everything was still fine but we have one conflict. A public folder had the same name as a user and thus had the same email address. We are getting the event:Event ID: 9514 Event Type: Warning Event Source: MSExchangeIS Description: Two objects in the Directory have the same proxy - /DC=COM/DC=[DomainName]/CN=[ContainerName1]/CN=[Object1] and /DC=COM/DC=[DomainName]/CN=[ContainerName2]/CN=[Object2] I deleted the public folder b...

Unable to create more Windows NT accounts for Exchange mailboxes
Hi Guys, Currently our Exchange server stopped allowing the creation of more Windows NT Accounts with the following error"Insufficient System Resources exist to complete the requested service".Pls is there a way out of this? We run Exchange 5.5 SP3 on Windows NT Server. -- Buchi ...

Please Help
I keep getting this Problem Event Name: BlueScreen OS Version: 6.1.7600.2.0.0.256.48 Locale ID: 1033 Additional information about the problem: BCCode: 1a BCP1: 00005003 BCP2: 8A000000 BCP3: 00005BFD BCP4: B67AF009 OS Version: 6_1_7600 Service Pack: 0_0 Product: 256_1 Files that help describe the problem: C:\Windows\Minidump\122609-26379-01.dmp C:\Users\Johnbebe\AppData\Local\Temp\WER-38891-0.sysdata.xml Read our privacy statement online: http://go.microsoft.com/fwlink/?link...8&clcid=0x0409 If the online privacy statement is not available, please read our p...

OWA problems #6
Users from outside the firewall can logon succesfully into OWA interface, their mailbox opens, but in the reading pane the only message is "loading..." Also no other functions of OWA interface seems to work (new, contacts...) as well as log off button. However if I try to access OWA from inside the company everything is fine. Windows 2000 Server SP4 Exchange 2003 SP1 On Thu, 6 Oct 2005 11:33:14 -0700, "Ducukm0" <Ducukm0@discussions.microsoft.com> wrote: >Users from outside the firewall can logon succesfully into OWA interface, >their mailbox opens, but in t...

How to realize communication problem?
Hello everybody. I am working on a project in which I read/write data via rs-232 from/to my Windows application to/from an microcontroller. Now, my boss wants me to write a library which he can use for different microcontrollers. This library should store any changes of data. So the desired microcontroller should just be able to pick up the data. You can think of it this way: Me, representing the Windows application, put a sheet of information into a drawer. A buddy of mine, (representing a microcontroller) can go to the drawer an pick up the sheet for further treatment. So, my quest...

Exchange Server 2003 Fails to Start after reboot
Since rebooting our Exchange 2003 server running on Windows 2003 server it fails to start the System Attendant and any further exchange services. The only way to logon to the server is boot in safe mode with networking. The server is a member server and is reporting the following errors EVENT 2114 MSExchange DS Access Process INETINFO.EXE (PID=1720). Topology Discovery failed, error 0x80040a02. EVENT 2102 Process MAD.EXE (PID=2176). All Domain Controller Servers in use are not responding: crstgs003.CRSTG.LOCAL crstgs004.CRSTG.LOCAL EVENT 2114 Process MAD.EXE (PID=2176). Topology Discovery ...

Upgrading from Exchange 2000 Standard to Enterprise Cal ? #2
Hello Everyone, I know the upgrade process from exchange 2000 standard to enterprise seems pretty straight forward. However, I have a cal question. Are my standard cals still good with this upgrade. Say I have right now standard 2000 with 30 cals. If I upgrade to Exchange 2000 Enterprise with 25 cals to pass the 16mb limitation. Would I then only have the 25 cals or 55 total cals? Thanks ...

Problems getting to server?
I have a customer who is saying that if he tries to get to a email server I am running, he can't get to it on the 1st attempt using Outlook Express. He has to browse to a web page that I am hosting, view that page. Then open OE, and his email will work fine. Has anyone heard of this, and have any solutions? Thanks, Steve Ask in an Outlook Express forum. This is an Microsoft Office Outlook forum. Outlook Express is family of Internet Explorer and Outlook of the Office family. Here is the link for the right forum http://communities.microsoft.com/newsgroups/default.asp?icp=Internet...

Help pulling "pingable" IP of local machine into a variable
Ok, here's my need. I am writing a script that does a few things, but I'm having trouble just pulling the "production" IP address into a variable, to then use in the rest of the script. I've see plenty of scripts to ping remote hosts, but that's not what I need. I've also worked up a few scripts on my own, but they all pull every IP on the machine, or require you to know the intenal ID of the NIC interface you need queried. The issue with this is that the ID is assigned randomly, and it's something you just have to know. I'm rather new at VBSc...

Exchange 5.5 <-> Exchange 2000 cannot rebuild ADC
I have two servers, one is Exchange 5.5, one is Exchange 2000. They are normally connected via the ADC. However, occasionally, these servers will lose sync, and the only previous recourse was a reboot, and a rebuilding of the ADC. Required a bit of extra "manpower", but it got the job done. So, we went through and tried it again to fix a problem, and now we cannot get the ADC back up. When I try to set the destination or source for the ADC to place/get information to/from the Exchange 5.5 system, I get the following error: "The Exchange server specified does not meet the...