Actually the domain user is me. And crazy, I'm one of the network admins. I have admin rights. However about a few days ago I needed to change my password, so I did. After that, a few seconds after I log on to my workstation (or any workstation for that matter) I get locked out of the network. I have to RDP to our PDC server then unlock myself, which in a few seconds to minutes, locks me out again. I had read somewhere that this might be a virus, so I ran a scan on my workstation, but it didn't find anything, plus this happens regardless of what workstation I'm on. I have tried some of the account lockout tools that I had read about, but again, it is saying the PDC is locking me out. I have rebooted that server, thinking that maybe I was logged on somewhere else, but have now rebooted all servers in the domain. Still having this problem. Any suggestions? This is very frustrating to be constantly locked out and have to log on with the admin account. Heck it is very difficult to even read emails. Any help would be greatly appreciated. BillBill

The best approach is to enable auditing/account management in the domain so that you can log the source of the lockout. Once auditing is enabled, look for event id 4740 on your DCs. not necessarily a virus. A virus or other malware would be using your current credentials. Could be someone else using your old credentials, but from experience I thinkg... What is most likely occuring is that you are logged on to at least one other workstation or server. When you changed your password, you still have a session somewhere still logged on with old credentials. Also, other things to look for...have you created any scheduled tasks using your user ID and old password. That wouldnt be a good idea. Also, if you have installed software using your credentials, you may have services on servers on the network that are using your credentials to run the application. another bad idea. Visit: anITKB.com, an IT Knowledge Base.

The virus might be on the network its not necessary that it should be on the server. Please download the conficker detection tool on your network from mcafee it will ease your work if you have lot of computers on your network http://www.mcafee.com/us/threat-center/confickertest.aspx http://www.virmansec.com/blogs/skhairuddin

Hello, I suspect that there is an application / service that is running using this account with the old password. I suggest tracking that. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified IT Professional: Enterprise Administrator

Well I have attempted to reboot most of the servers (the only computers so far I can think of I was last logged on to). Still having same issues. Although now it takes a few minutes instead of a few seconds to lock my account. Bill

Tried this, shows all computers on network as clean.Bill

check this link where I have mentioned common causes for account lockouts. http://social.technet.microsoft.com/Forums/en-IE/winservergen/thread/aaa59d9d-09f6-4127-93a1-2d855237c22fhttp://www.virmansec.com/blogs/skhairuddin

depending on the version of Windows Server you have, tracking down lockouts can be easy or hard :) take a look at this and the related/linked information: http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/bdb21f14-06ea-44b8-96ab-7f85a2f2c3c3 http://technet.microsoft.com/en-us/library/cc776964(WS.10).aspx (server 2003)Don

Hi, If there is any update on this issue, please feel free to let us know.Brent Hu Forum Support Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

I have been out of the office for a few days. Still having the same problems, but I'll review the documents and links provided and let you know. Thanks, BillBill

My account finally returned to normal. I believe you were correct, another server had my old account still logged on. Thanks for your help everyone.Bill