Account Locks outs after 5 minutes Automagically??

Printable View

September 1st, 2004, 02:16 PM
LaSERCHiPs

Account Locks outs after 5 minutes Automagically??

I have one user...who's account will always lock out...I can manually
unlock the account...but 5 minutes later it's locked again...no body
is trying to hack in and nobody is trying to use this account ...This is a very, very small company...The event log was giving me this error...

Event ID: 1058

Windows cannot access the file gpt.ini for GPO
CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=<DOMAIN
NAME>,DC=com. The file must be present at the location <\\<DOMAAIN
NAME>\sysvol\<DOMAIN
NAME>\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>.
(Access is denied. ). Group Policy processing aborted.

But I think I cleaned this up by running - dfsutil /PurgeMupCache

(I haven't received this msg for a while. I was receiving it every half hour)

I thought It was group policy related but...I only have the Default
GPO's and I disabled all account lockout options...

Any thoughts on why this is happening???

!Poor guy can't get his email...or do his drawings!

OS Specs...Microsoft Windows 2003 Standard Server <all updates installed>
September 1st, 2004, 02:25 PM
TechZ

Quote:

automagically

LOL
September 2nd, 2004, 03:24 AM
emr

Quote:

Originally Posted by LaSERCHiPs

I have one user...who's account will always lock out...I can manually
unlock the account...but 5 minutes later it's locked again...no body
is trying to hack in and nobody is trying to use this account ...This is a very, very small company...The event log was giving me this error...

Event ID: 1058

Windows cannot access the file gpt.ini for GPO
CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=<DOMAIN
NAME>,DC=com. The file must be present at the location <\\<DOMAAIN
NAME>\sysvol\<DOMAIN
NAME>\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>.
(Access is denied. ). Group Policy processing aborted.

But I think I cleaned this up by running - dfsutil /PurgeMupCache

(I haven't received this msg for a while. I was receiving it every half hour)

I thought It was group policy related but...I only have the Default
GPO's and I disabled all account lockout options...

Any thoughts on why this is happening???

!Poor guy can't get his email...or do his drawings!

OS Specs...Microsoft Windows 2003 Standard Server <all updates installed>

The gpt.ini message is a damn pain and so far the only way I have resolved it is to run dfsutil /PurgeMupCache as you mentioned. Seems to be an underlying problem with 2k3 which they will hopefully resolve with SP1.

Have you tried deleting and recreating his account? May do the trick.

emr
September 2nd, 2004, 10:39 AM
LaSERCHiPs

Quote:

Originally Posted by emr

The gpt.ini message is a damn pain and so far the only way I have resolved it is to run dfsutil /PurgeMupCache as you mentioned. Seems to be an underlying problem with 2k3 which they will hopefully resolve with SP1.

Have you tried deleting and recreating his account? May do the trick.

emr

I would rather not...this sever is also the exchange server...and when deleting his account really messes up the mailbox associated with his account...

Microsoft does have a hotfix for this issue...I think I will call them on Tomorrow I will let you all know how that goes...Strange that it only affects one account
September 3rd, 2004, 10:22 AM
drewmaztech

We had the same problem on our network. There was no reason for the lockout - it would just lock itself out.
We ended up deleting the account (it happened to be MINE) and recreated. Then all was well.
September 3rd, 2004, 03:11 PM
LaSERCHiPs

I feel like I'm on the Titanic...Services are starting fail all over the place...

I can't open <server_name/sysvol> anymore...access is denied

Group Policy editor...access is denied...

I'm logged in as administrator!!!

What's going on...The same gpt.ini error in the event log...every half hour...6 maybe 7 new entries occure...

I can only purge the mup cache so often...I thought this was supposed to fix this issue...

Not impressed....so much for my long weekend
September 3rd, 2004, 04:37 PM
amyb

Quote:

Originally Posted by LaSERCHiPs

I feel like I'm on the Titanic...Services are starting fail all over the place...

I can't open <server_name/sysvol> anymore...access is denied

Group Policy editor...access is denied...

I'm logged in as administrator!!!

What's going on...The same gpt.ini error in the event log...every half hour...6 maybe 7 new entries occure...

I can only purge the mup cache so often...I thought this was supposed to fix this issue...

Not impressed....so much for my long weekend

I had something like that happen to me(though the server wasn't in the production mode yet), I had to reinstall. Is there anything in the Event Log?
September 3rd, 2004, 09:25 PM
LaSERCHiPs

Quote:

Originally Posted by amyb

I had something like that happen to me(though the server wasn't in the production mode yet), I had to reinstall. Is there anything in the Event Log?

SURE THERE LOTS IN THE EVENT VIEWER!!!

Event ID: 1030
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

Event ID: 1058
Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=<DominaName >,DC=com. The file must be present at the location <\\<DomainName>.com\sysvol\<DomainName>.com\Polici es\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (Access is denied. ). Group Policy processing aborted.

Over and Over again!!!

If I can get access to the sysvol folder again I think I'm Golden!!

ANY thoughts!!
September 8th, 2004, 01:37 PM
LaSERCHiPs

Well I contacted Microsoft and then sent my the Hotfix to correct the problem...and...drum roll...dadadadadadada....DID NOT WORK...

I was sent 4 patches...2 of them were for XP sp2...thanks but no thanks...

One was for a IA86 Platform ??? don't know what that is...

and finally then only one I installed...didn't seem to correct this issue

Anythoughts how you would fix this issue...remember this is a live production machine...
January 24th, 2005, 12:24 PM
LaSERCHiPs

Quote:

Originally Posted by LaSERCHiPs

Well I contacted Microsoft and then sent my the Hotfix to correct the problem...and...drum roll...dadadadadadada....DID NOT WORK...

I was sent 4 patches...2 of them were for XP sp2...thanks but no thanks...

One was for a IA86 Platform ??? don't know what that is...

and finally then only one I installed...didn't seem to correct this issue

Anythoughts how you would fix this issue...remember this is a live production machine...

I HAVE SOLVED THIS PROBLEM
January 24th, 2005, 01:26 PM
TechZ

Please share the solution for others.
January 24th, 2005, 02:35 PM
Ya_know

Quote:

Originally Posted by TechZ

Please share the solution for others.

Yeah, how about that. We've been on pins and needles for 4 months now!!!
January 25th, 2005, 12:54 PM
LaSERCHiPs

Quote:

Originally Posted by Ya_know

Yeah, how about that. We've been on pins and needles for 4 months now!!!

It's a long story...

Lets just say that over the christmas break our Symantec Mail Security for Exchange went south for the christmas break and allowed a couple of viruses in and brought the server to a grinding hault...inetinfo.exe consumed 100% of the CPU...@ the time i had no clue what just happened other then inetinfo was @ 100% and the server was infected...I still didn't know that SMSME was not working correctly...the services were running...and I soon release that the Admin account was locked out of many apps...although I could browse to all the directories and files...most of the MMC consoles gave me ACCESS IS DENIED

After cleaning the virus out I still couldn't get the server up and running so I had to call M$...after 18 hours we finally got the exchange server to receive and deliever mail...[ had to reinstall IIS and exchange (twice)] and still after a reboot; the exchange information store wound not start... I was still getting the 1030 & 1058 Events and a new exchange event 9287 (I Think)...A couple of days later I notice the SMSME was not up-to-date so I stopped the services and restarted...and down went exchange...same thing inetinfo.exe 100%...I quickly uninstalled SMSME and that solved my problem; I reinstalled SMSME and that was working again. But I was still getting the 1030 & 1058 Events and the new exchange event 9287 [recepient policy error envolving GPT.ini].

so I reasearched and googled around and found people used different steps to solve the problem...none seemed to worked for me...I was just about to rebuild the server when I came across an article that said rebuiding ther server doesn't work you need to do these steps [This was like on search page 22 way out in the middle of nowhere]...I had to revesered the order because I tried some of the steps before with no success and bingo bango bongo...the sever booted normal...and has been running stable for 3 days with no errors in the event log...

Steps Taken

I Installed the group policy management service pack

http://www.microsoft.com/downloads/d...displaylang=en

added FQDN of my domain controller to the host file

Changed some registry setting
[disabling the enable secure signature and requires a secure signature]
HKLM\System\currentControlset\services\lanmanserve \paramaters

**This stop the error in the event log but I still was locked out of many consoles
and still receiving the exchange error**

I recreated the security database with the security analysis and configuration tool and Rebooted server

And to my surprise everything came up normal

I still have this error appearing on my file server but I think I can solve this...it very random...like every 4 hours or so...as well a client having an issue receiving any Group Policies.

Sorry for the delay in repsonse but I had to notify all parties envloved that the server was finally running stable; M$ included...

I hope I never have a problem like this again...