OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
RE: Account Lockout -- ARGH

From: Marsha Cipollone (Marsha.Cipollonestclair.org)
Date: Fri Aug 15 2003 - 12:35:39 CDT

We ran into this yesterday as well. In our case it was SMS 2.0 causing
the problem. I am still working on the root cause of the issue, but it
appears that if you were a SMS admin, your account was repeatedly locked
throughout the day. Not sure of the significance of the SMS admin yet,
but...it may be another direction to pursue if you are running SMS.

-----Original Message-----
From: Carrera, Art [mailto:ACARRERAvha.com]
Sent: Friday, August 15, 2003 12:34 PM
To: Grabowski, David; SecurityFocus-MS (E-mail)
Subject: RE: Account Lockout -- ARGH

I've seen this too. In my case, it turned out to be a "persistent"
Terminal service connection that had not been closed properly by the
user. While this connection was "alive", the user correctly changed his
password. Meanwhile, the persistent Terminal Service connection kept
trying to reuse the "old" password and it locked the account.

hope this helps.

Art Carrera
security analyst
VHA, Inc.

-----Original Message-----
From: Grabowski, David [mailto:david.grabowskius.mizuho-sc.com]
Sent: Thursday, August 14, 2003 3:05 PM
To: SecurityFocus-MS (E-mail)
Subject: Account Lockout -- ARGH

I'm running into some serious problems with users on our domain getting
their accounts locked out repeatedly.

All W2K, SP3.

No services are configured to run as any of these users.

Usually in the morning, when the users log in, they let us know that
their accounts are locked out. Occasionally problems pop up during the
day -- i.e., a user closes Outlook and then restarts it at some point
later. Somehow, his account got locked during that time, so Outlook
won't start for him.

All security events are logged.

Event logs on the workstations vary; some show a number of 529's
(unknown username and password) followed by an account lockout. Others
simply show the lockouts and nothing else. Some show nothing at all.

Event logs on the domain controllers show occasional 677's (service
ticket request failed - although from what I've read, these are normal),
and frequent 675's (pre-authentication failed).

I've done the requisite research at eventid.net, the MS KB, and Google;
nothing of any significance.

Users are not logged on at more than one workstation. Actually, we
recently got everyone into the habit of remembering to log off at the
end of the day. (They learned after we started pushing updates that
would reboot their machines at night and their open documents wouldn't
get saved)

Time is synchronized on all machines.

Our Default Domain Controllers Policy enforces: Account lockout duration
(0), Account Lockout Threshold (10 invalid attempts), and Reset account
lockout counter after (60 minutes)

Any ideas?

---------------------------------------------------
David Grabowski
Mizuho Securities USA, Equity Division
(212) 209-9349
########################################################################
#############
CONFIDENTIAL: This e-mail, including its contents and attachments, if
any, are confidential. It is neither an offer to buy or sell, nor a
solicitation of an offer to buy or sell, any securities or any related
financial instruments mentioned in it. If you are not the named
recipient please notify the sender and immediately delete it. You may
not disseminate, distribute, or forward this e-mail message or disclose
its contents to anybody else. Unless otherwise indicated, copyright and
any other intellectual property rights in its contents are the sole
property of Mizuho Securities USA Inc.
     E-mail transmission cannot be guaranteed to be secure or
error-free. The sender therefore does not accept liability for any
errors or omissions in the contents of this message which arise as a
result of e-mail transmission. If verification is required please
request a hard-copy version.
     Although we routinely screen for viruses, addressees should check
this e-mail and any attachments for viruses. We make no representation
or warranty as to the absence of viruses in this e-mail or any
attachments. Please note that to ensure regulatory compliance and for
the protection of our customers and business, we may monitor and read
e-mails sent to and from our server(s).
########################################################################
#############

------------------------------------------------------------------------
---
Your network firewall and IDS products do not prevent Web application
attacks - the most common form of online exploitation- resulting in Web
defacement, data theft, sabotage and fraud.
KaVaDo is the only company that provides a complete suite of Web
application security products.
Download a FREE whitepaper on "Security Policy Automation for Web
Applications":http://www.securityfocus.com/Kavado-focus-ms
------------------------------------------------------------------------
---

------------------------------------------------------------------------
---
Your network firewall and IDS products do not prevent Web application
attacks - the most common form of online exploitation- resulting in Web
defacement, data theft, sabotage and fraud.
KaVaDo is the only company that provides a complete suite of Web
application security products.
Download a FREE whitepaper on "Security Policy Automation for Web
Applications":http://www.securityfocus.com/Kavado-focus-ms
------------------------------------------------------------------------
---

Email contains Privileged & Confidential Information intended only for the recipient named. Dissemination or copying of email is strictly prohibited. If you have received this in error, notify St. Clair Hospital & return or destroy original. Information in this email is confidential & protected by state & federal law. Further disclosure is strictly prohibited.

---------------------------------------------------------------------------
Your network firewall and IDS products do not prevent Web application
attacks - the most common form of online exploitation- resulting in Web
defacement, data theft, sabotage and fraud.
KaVaDo is the only company that provides a complete suite of Web
application security products.
Download a FREE whitepaper on "Security Policy Automation for Web
Applications":http://www.securityfocus.com/Kavado-focus-ms
---------------------------------------------------------------------------