SYMPTOMS
An Event ID: 644 message similar to one of the following may appear in
the security log, even though no user accounts have been locked out because of bad
logon attempts: Event ID: 644.
Audit Success.
Event User: NT AUTHORITY\ANONYMOUS LOGON.
Event Source: Security.
Event Detail: User Account Locked Out:
Event ID: 644.
Audit Success.
Event User: NT
AUTHORITY\SYSTEM.
Event Source: Security.
Event Detail: User Account
Locked Out:
Target Account ID: SYSTEM The Event ID: 644 - User
Account Locked Out security event is generated at the primary domain controller
(PDC) to indicate that the user account was automatically locked out because of bad logon
attempts. The security event is generated if the audit policy for the domain
enables the Success for the User and Group Management audit category.
However, this message may incorrectly appear in the security log, and
it may
not indicate that an account has been locked out because of bad logon attempts.
RESOLUTION
A
supported fix is now available from Microsoft, but it is only intended to
correct the problem that is described in this article. Apply it only to
computers that are experiencing this specific problem.
To resolve
this problem, contact Microsoft Product Support Services to obtain the fix. For
a complete list of Microsoft Product Support Services phone numbers and
information about support costs, visit the following Microsoft Web site:
NOTE: In special cases, charges that are ordinarily incurred for
support calls may be canceled if a Microsoft Support Professional determines
that a specific update will resolve your problem. The usual support costs will
apply to additional support questions and issues that do not qualify for the
specific update in question.
The English version of this fix has the file attributes
(or later) that are listed in the following table. The dates and times for
these files are listed in coordinated universal time (UTC). When you view the
file information, it is converted to local time. To find the difference between
UTC and local time, use the
Time Zone tab in the Date and Time tool in Control Panel.
Date Time Version Size File name
------------------------------------------------------
01-Mar-2002 21:22 4.0.1381.7114 155,920 Lsasrv.dll
01-Mar-2002 21:22 4.0.1381.7138 174,864 Samsrv.dll
Note Because of file dependencies, this hotfix requires Windows
NT 4.0 Service Pack 6a.