In a Windows 2003 domain users (out of the blue) get logged out with a resulting Event ID: 680 and Error Code: 0xC0000234 in the security log. I have been trying to find a pattern in who gets logged out with little success. The only new "thing" I can think of, is that we're now getting Windows 7 PC's in the domain. Our 2 DCs are fully patched, but getting on a bit (Don't we all) Niels Werner Mortensen

Hi, Please confirm whether the user account is forced to logoff or the user logs off and fails to logon again, for the user account has been locked out. As for the event 680, it indicates that the user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested. To identify the cause, please first check if there is any computer infected by virus: Virus alert about the Win32/Conficker wormhttp://support.microsoft.com/default.aspx/kb/962007 If this is not the case, please enable the following audit at the domain level: Account Logon Events FailureAccount Management SuccessLogon Events Failure And then, collect MPSReport on all domain controllers in the domain once the issue occurs again: 1. Download MPSReport from the following linkhttp://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd915706/MPSRPT_DirSvc.EXE2. Double-click the executable to launch the report gathering tool on the domain controllers.3. After the tool finishes gathering the information, you will a .cab file in C:\WINDOWS\MPSReports\DirSvc\cab folder. Please upload the .cab file to the following space:https://sftasia.one.microsoft.com/choosetransfer.aspx?key=ab53c5bf-4065-4b56-a3ec-4dc2d95c228dPassword: @O*Fm8MVS7 For more information about the troubleshooting steps and common causes for account lockouts, please refer to the following article: Troubleshooting Account Lockouthttp://technet.microsoft.com/en-us/library/cc773155(WS.10).aspx Joson ZhouTechNet Subscriber Support in forumThis posting is provided "AS IS" with no warranties, and confers no rights.

Hi,How's everything going? We've not heard back from you in a few days and wanted to check the current status of the issue. If you need further assistance, please help collect the information and upload to the space.Thanks.This posting is provided "AS IS" with no warranties, and confers no rights.