Seeing continous "Windows Account Locked" alert in Cisco IPS

Hi,
Can any one have any idea on why we are seeing huge number of "Windows Account Locked" alert in Cisco IPS device towards only one Windows server.
We checked whether Windows server is generating any malicious traffic by scanning the server but nothing is found
Feb 23 2011 20:05:47
Windows Account Locked
Cisco Intrusion Prevention System
Feb 23 2011 20:05:32
Windows Account Locked
Cisco Intrusion Prevention System
Feb 23 2011 20:04:47
Windows Account Locked
Cisco Intrusion Prevention System
Feb 23 2011 20:04:32
Windows Account Locked
Cisco Intrusion Prevention System
Feb 23 2011 20:03:47
Windows Account Locked
Cisco Intrusion Prevention System
Feb 23 2011 20:03:32
Windows Account Locked
Cisco Intrusion Prevention System
Feb 23 2011 20:02:47
Windows Account Locked
Cisco Intrusion Prevention System
Feb 23 2011 20:02:32
Windows Account Locked
Cisco Intrusion Prevention System

Mustafa,
Here are the signature details:
http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=5605&signatureSubId=0&softwareVersion=6.0&releaseVersion=S262
This signature detects a Windows SMB user account that has been locked on the Windows server due to multiple failed logon attempts, via the "STATUS_ACCOUNT_LOCKED_OUT" message returned to the client.
This signature severity is set by default to 'informational'
Hence all the signature is doing is leeting you know some users were locked out due to multiple logon attempts.
The event details will also reveal victim ip which might be the machine on which the logon attempts were tried.
Let me know if this addresses your concern.
- Sid

Similar Messages

DBSNMP account locked alert email is not generated.

In oem 11g when dbsnmp accout is locked, database target use to go down and it would send an automated alert.
But in oem 12c we are not receiving any notificaitons when dbsnmp accout is locked as the target is not going down, how can this alert be monitored??

Hi,
The DB status metric goes through connection pool to connect to the target database. Once the connection is established, dbsnmp password changes/expiry etc wont' affect the collection of the metric so it won't show the target as down. There isn't currently any metric that detects issues with DBSNMP account, this is an open enhancement for us. Let me try to find a solution and get back to you on this.
Regards,
Ana

TS2446 Account Locked Alert

What if my ID has been locked but my email address on file is no longer valid, how do I recover my password to change my email address?

how do i access my questions

LDAP account locking with Windows (smbldap)

We're running directory server 7 in our area and it's all set up and
working. We're using the smbldap-tools in conjunction to have the
directory server allow domain logins.
The main issue is that we want to enforce account lockouts after 5
failed attempts. When using the built-in password policy in the
directory server to do this, and a user locks their account, they can no
longer log into any of the linux systems (what we want). However, with
windows, a user can still log in with their current password, if they
type a bad password, they get an error saying there's a problem with
their account....so the locking doesn't work.
My theory is just that the LDAP server is preventing windows from seeing
some of the attributes once the account is locked...probably preventing
info from being written to the samba bad password count.
Do you know if there's a way to modify the LDAP server configuration
such that when an account is locked out, to modify OTHER attributes than
the defaults? So, if the directory server enables the lockout, it
modifies not only the pwdaccountlockedtime field, but also, say,
sambaAccountFlags?
Thanks for any tips.

We're running Windows XP systems. Unfortunately we're not running AD, but rather a Samba server, which is storing its information in the Sun Directory Server. I'm not sure if the Identity Synchronization will work with Samba or not. I can also take a look at this windows bug and see if maybe just changing the timeout on the old passwords. If that prevents people from logging in due to an account locking, good enough for me. I think the biggest concern is that we prevent users from accessing their accounts in the event they get locked.
Is what I'm trying to do possible with an ACI perhaps? I'm not familiar enough with the ACIs to know. So, basically IF the pwdaccountlockedtime flag OR the smbacctflag looks a certain way, prevent users from accessing any information from the LDAP server.

SQL 2012 DB Engine [Login failed: Account locked out] alerts not received from SCOM 2007 R2

Dear Experts,
In our SCOM 2007 R2 environment SQL 2012 DB Engine [Login failed: Account locked out] alerts not received but we are receiving the following alerts fr the DB instance.
1. Database Backup Failed To Complete
2. Login failed: Password expired
3. Log Backup Failed to Complete
4. Login failed: Password cannot be used at this time
5. Login failed: Password must be changed
6. IS Package Failed.
Why we are not receiving the "Login failed: Account locked out" ? Customers are asking the notification email alert for this Rule even I have checked the override settings everything is enabled by default same as above rules.
What can be the issue here ?
Thanks,
Saravana
Saravana Raja

Hi,
Could you please check the Windows security log for (MSSQLSERVER) event ID 18486? The rule should rely on this event.
Regards,
Yan Li
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Trying to connect to a Windows share locks out users Windows account.

Right then I’m coming to the end of my tether !!!
I've got a user who needs to access a share on a Windows server. All is well and the user gets the challenge prompt but instead of letting him in it constantly challenges him locking out his windows account.
Now the share is on a DC so i cant make him a local Admin and the only way i can get this working is to have him in the domain admin group which is NOT the way forward, so i'm looking at permissions i guess.
Can anyone point me in the right direction to fix this .. Arhhhh

The Seagate drive at Amazon should work fine.
Your Maintenance & Service Guide may be helpful:
http://h10025.www1.hp.com/ewfrf/wc/manualCategory?cc=us&dlc=en&docname=c03898001&lc=en&product=54381...
******Clicking the Thumbs-Up button is a way to say -Thanks!.******
**Click Accept as Solution on a Reply that solves your issue to help others**

Windows 2008- Account Lock not working and getting Domain Policy access denied

Hi
Windows 2008 Root Domain we tried to Edit the policy and we were getting the error "Access Denied on the Domain Policy template" we resolved by giving Write permission for authenticated user on the Template. later we applied account lock out policy.
but it is not applying and automatically reset to 0 in account lockout tool.
Error:"Access Denied:\\sysvol\Domain.com\policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Windows NT\SecEdit\GPTmpl.inf.Make sure that you have the right permission to this object.

Hi,
The error message is Access Denied, so it should be a permission issue.
You mentioned that you tested the account lockout in isolated network, it was working fine without any problem, by which did you mean that you didn’t get the Access Denied error message, or account wasn’t lockout out?
If you are facing account lockout problem, here are some troubleshooting articles below for you:
Troubleshooting Account Lockout
http://technet.microsoft.com/en-us/library/cc773155(v=WS.10).aspx
Troubleshooting account lockout the PSS way
http://blogs.technet.com/b/instan/archive/2009/09/01/troubleshooting-account-lockout-the-pss-way.aspx
Appendix Two: Gathering Information to Troubleshoot Account Lockout Issues
http://technet.microsoft.com/en-us/library/cc778156(v=WS.10).aspx
Best Regards,
Amy

Service accounts locked out issue.

Hi,
While monitoring production servers, I noticed that all the Host Instances were stopped. In the Event log, I could see several Account Locked notifications (Service accounts for Hosts). Below are the relevant error messages that I could see in the event
log for this exception.
"The BTSSvc$My_Host service was unable to log on as mydomain\SvcAccount with the currently configured password due to the following error:
The referenced account is currently locked out and may not be logged on to."
"Windows saved user mydomain\SvcAccount registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.
This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account."
I am not able to figure out the root cause and the possible remedy. Please let me know your thoughts about the issue.
Thanks and Regards,
Ujjwal
-Ujjwal

If this is the first time this has occured then it is possible that someone did change the service account passwords. Can you logon onto the BizTalk Machine using the Account & Password? If someone has changed the passwords you will need to go to each
machine, services.mmc and manually enter the password for each of the affected services.
If this is a recurring problem, it may be because of a Downadup.B infection and you'd need to take it up with the AntiVirus control team to help identify/rectify this.
Regards.

MacBook Pro Causing Account Lock-Out in Active Directory

Dear fellow forumers,
I'm having a MacBook Pro, running on Leopard. I'm running WinXP Pro on VM Fusion.I'm connecting my MacBook to a Local LAN enviroment in my company, but it is not bind to any AD.
But concurrently when i run WindowsXP Pro on VM Fusion, i actually join domain in the XP Pro.
If anyone can advise, what may be causing the frequent account lock-out whenever i run WindowXP on VM Fusion?

I'm having the same issue under Parallels. I connect to my corporate network using Cisco VPN. I have Entourage configured and Outlook configured in my VM. Cisco VPN is configured for both the Mac OS and for Windows XP within Parallels. I never run both simultaneously. If I connect to VPN within MacOS X, I can have both Entourage and Outlook open and the same time. I seem to notice more frequent lockouts when I do this. I have also tried running Entourage via OWS. This removes the need to use VPN on the Mac. However, I still get lockouts...just not as frequently. Any help greatly appreciated.

Problem sharing iTunes with multiple Windows accounts

My kids and I share a single computer via multiple user accounts. We also share a common iTunes account across all Windows accounts. When new songs or playlists are added, they appear in the other accounts.
Recently, I had to create a new Windows account for my daughter. In iTunes, I went to Edit -> Preferences and changed the iTunes Media folder location to the shared folder. The problem is that none of the playlists came through, and when new songs are added, they do not show up in her account either.
What could be causing this problem on just this account, and what is the possible fix?
Thanks,
Jeff

If you create multiple user accounts on one computer but want the same music to be available in iTunes for all users, see iTunes: How to share music between different accounts on a single computer.
The important stuff is near the bottom
+To listen to another account's music files+
+Open iTunes.+
+From the iTunes menu, choose Preferences.+
+Click Advanced.+
+Deselect the "Copy files to iTunes Music folder when adding to library file" option.+
+Click OK.+
+From the File menu, choose Add File to Library.+
+Note: Windows users can also choose Add Folder to Library to add a folder of songs.+
+Navigate in the Add File To Library window to the location where the other user's music is saved (the iTunes Music folder in the case above).+
+Click Open.+
+Repeat these steps for each account that is listening to shared music.+
+When another user of the computer has imported new music from CD, *repeat steps 6 through 8* to add the music to your library.+

Using iTunes with multiple Windows accounts

A friend of mine has 2 Windows accounts on his Win XP machine. He uses iTunes on each account, but has his music in a shared location. If he has music playing in iTunes on one account and then uses Fast User Switching to log into the second account, the current song continues to play but the next song and every song thereafter will be very jerky. Like trying to stream music with a slow internet connection.
Any thoughts.

hiya!
hmmmm. it might well be the Windows Fast User Switching causing his problem (although he isn't getting the usual problem i see associated with Fast User Switching):
iTunes for Windows: about Fast User Switching with Windows XP
love, b

Migrate Nokia Suite between windows accounts

I have recently changed my home pc so that each user has their own account, I now want to move my Nokia Suite settings to my personal windows account rather than the shared windows account.
My issue is that I have a lot of photographs stored on my N8, these have already been uploaded to windows (shared account) - but if I connect the N8 while logged in with my new windows account Nokia Suite tries to upload all the photos again, this would turn into a massive problem for me to sort out manually.
What can I do to migrate my Nokia Suite data from one account to another - I see there are hidden "Nokia" and "Nokia Account" folders in AppData/Local... would it be sufficient to copy these or is there other stuff that I would be missing?

Hi dylanf,
You can see the help of Nokia Suite "Moving the contents of Nokia Suite to a new computer", the same applies to creating a new account or profile on your same computer.
If you had your Photos and Videos from your phone stored on your shared account on PC in the standard Windows Pictures and Videos folders. You just need to copy them those to your new account's Pictures and Videos. This way you will not need to copy those photos again from your phone to your new account.
I copied here the instructions from the Nokia Suite help. Nokia Suite -> Help -> Moving the contents of Nokia Suite to a new computer.
When you are switching to a new computer, it's easy to move your contacts, messages, media files, calendar information, bookmarks, and web feeds from Nokia Suite on your old computer to Nokia Suite on the new computer. All your files stay safe and you can continue using Nokia Suite just like before. See below for detailed instructions on how to move different content types to your new computer.
Music, photos, and videos
The music, photos, and videos you see in Nokia Suite are stored on your computer just like any files and you can move them to the new computer with the help of Windows Explorer and an external hard drive, such as a USB memory stick. In the options of Nokia Suite, check if the program saves your media files to the standard Windows folders for music, photos, and videos (such as Music, Pictures, and Videos on Windows Vista and Windows 7 or My Music, My Pictures, and My Videos on Windows XP), or if you have chosen to save them in some other folders. To check your options, open the Tools menu, click Options, and then go to the Music and Gallery tabs.
Note that if you have created music playlists or photo albums in Nokia Suite on your old computer, you need to create them again when you start using Nokia Suite on your new computer.

ScreenSharing won't show any windows. Can see windows Genie effect - just can't see the windows.

Running System Version: OS X 10.9.2 (13C64) "Server".
As stated - When I use ScreenSharing to access my account, I can see the windows minimize and maximize with Genie, I can see the windows in the dock when they are minimized, but they are not visible on the screen once I bring them 'up'.
See video :
http://youtu.be/R9OUDIOZfLs
No other users are complaining of this, but I'm a remote user in another state. I haven't accessed this machine since they upgraded to 10.9.2. I'm a local admin and I had a problem with the stupid keychain junk so I did remove ~/Library/Keychains/ and reboot the machine however the problem was there before I junked the keychain stuff.

Please read the warranty paperwork that came w/your computer.
You have 14 days to return the computer w/no questions asked.
You have 90 days of FREE phone tech support on top of your standard 1 year warranty unless you also purchased AppleCare which gives you an additional 2 years of coverage plus FREE phone support.
Strongly suggest that you take FULL advantage of the above before it runs out. Let Apple deal w/the problems & your concerns. It's what you paid them to do.

I have windows 7 and can't link my windows account?

I have windows 7 and when I try to link my windows account it gives me a error message of your rbc server is unavailable. I saw to go to gpedit.msc but then another instruction said that only windows xp, vista and 2000 are supported? How can I link my windows account so I can get my windows media 11 to work on my direct tv extras?

You can also install that WMP plugin on Windows 7
See:
[[Using the Windows Media Player plugin with Firefox]]
http://kb.mozillazine.org/Windows_Media_Player#Missing_plugin

Using two windows accounts and 1 ipod directory

I've been trying to set up my computer so that my wife and I can log into our own windows accounts but still pull the itunes music from only one location. I have it set up so that the music gets stored in one location and each account reads the music from the location however when I try to download a CD into the file my account will read it but hers won't. And vise versa. Any ideas?

See our recently discussion on this in this post...
http://discussions.apple.com/thread.jspa?messageID=7262119
Cheers,
Patrick

Seeing continous "Windows Account Locked" alert in Cisco IPS

Similar Messages

Maybe you are looking for