Logon failure event 680, 529 but credentials are correct

Question

A bit strange on one Windows 2003 server.
Whenever I do a remote administration to the server such as connect from services.msc to this server remotely, doing a remote registry connection or doing an rpc call, it logs event 680 (0xC000006A) and 529 (Unknown User name or bad password), eventually
the account locked out.
It is true no matter which accounts I used, so it is not just affecting a particular account.
The credentials are correct because I can log on using the same username and password through remote desktop.
Any idea?
Valuable skills are not learned, learned skills aren't valuable.

Answer 1

Hi,
Please try to perfrom a clean boot on problematic 2003 server to check wether presist or not.
How to perform a clean boot in Windows XP/2003
=================================
1. Log on to the computer by using an account that has administrator rights.
2. Click Start, click Run, type msconfig in the open box, and then press ENTER to start the System Configuration Utility.
3. On the General tab, click Selective Startup, and then click to clear the Load startup items check box.
4. On the Services tab, click to select the Hide all Microsoft services check box, and then click Disable all.
5. Click OK, Choose Don’t show this message again and then click Restart.
If you want to start Windows normally after you do the test, Click Start, click Run, type msconfig in the open box, and then press ENTER to start the System Configuration Utility. On the General tab, click Normal Startup. Click OK, Choose Don’t show this message
again and then click Restart.
Please also check if you have cached any old credential on problematic client:
1. Open “Credential Manager” on the user’s machine under Control Panel, remove all saved entries related the user account.
2. Clear old credentials which stored under system content if have:
   a. Download the PSTOOLs from link below, and decompress to C drive:
http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx
   b. Open a Command Prompt with administrator privilege, and run “cd c:\pstools”.
   c. Run command “psexec -i -s -d cmd.exe”
   d. From the new DOS window run:  rundll32 keymgr.dll,KRShowKeyMgr
   e. Remove any items that appear in the list of Stored User Names and Passwords.  Restart the computer.
3. Check if there is service running as the user account on the user’s machine.
Thanks.