Microsoft KB Archive/814511

= &quot;Event ID: 644&quot; Message Even When No Accounts Have Been Locked Out Because of Bad Logon Attempts =

Article ID: 814511

Article Last Modified on 10/26/2006

-

APPLIES TO


 * Microsoft Windows NT Server 4.0 Standard Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition

-



SYMPTOMS
An Event ID: 644 message similar to one of the following may appear in the security log, even though no user accounts have been locked out because of bad logon attempts: Event ID: 644.

Audit Success.

Event User: NT AUTHORITY\ANONYMOUS LOGON.

Event Source: Security.

Event Detail: User Account Locked Out:

-or-

Event ID: 644.

Audit Success.

Event User: NT AUTHORITY\SYSTEM.

Event Source: Security.

Event Detail: User Account Locked Out:

Target Account ID: SYSTEM

The Event ID: 644 - User Account Locked Out security event is generated at the primary domain controller (PDC) to indicate that the user account was automatically locked out because of bad logon attempts. The security event is generated if the audit policy for the domain enables the Success for the User and Group Management audit category.

However, this message may incorrectly appear in the security log, and it may not indicate that an account has been locked out because of bad logon attempts.



RESOLUTION
A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to computers that are experiencing this specific problem.

To resolve this problem, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS

NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

 Date        Time   Version        Size     File name --  01-Mar-2002  21:22  4.0.1381.7114  155,920  Lsasrv.dll 01-Mar-2002 21:22  4.0.1381.7138  174,864  Samsrv.dll Note Because of file dependencies, this hotfix requires Windows NT 4.0 Service Pack 6a.



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

Keywords: kberrmsg kbqfe kbfix kbbug KB814511

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.