Security-kerberos Event ID 14 . credential manager causes system to login to network with invalid password and lock the account.
Hi , I am running windows 7 professional 64 bit on a quadcore xeon machine. My company IT policy requires that we change our account passwords every 2 months. After the last password change , my computer is locking me out of the network by trying to login with an invalid password stored somewhere in the credential manager. I have tried clearing the credential manager many times , no use. we checked all my machines, virtual machines, network drives, printers, none of them seem to solve the problem. Our IT specialist has checked our machines multiple times and found nothing. so far we know of two machines with the same configuration causing this problem. The only way to avoid being locked out is to turn off my machine at night. The login attempts occur at 5:00 am in the morning every day . The event viewer reports the following event . Log Name: System Source: Microsoft-Windows-Security-Kerberos Date: 10/22/2010 5:00:31 AM Event ID: 14 Task Category: None Level: Warning Keywords: Classic User: N/A Computer: computername.network.com Description: The password stored in Credential Manager is invalid. This might be caused by the user changing the password from this computer or a different computer. To resolve this error, open Credential Manager in Control Panel, and reenter the password for the credential Email removed for privacy. Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-Security-Kerberos" Guid="{98E6CFCB-EE0A-41E0-A57B-622D4E1B30B1}" EventSourceName="Kerberos" /> <EventID Qualifiers="32768">14</EventID> <Version>0</Version> <Level>3</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2010-10-22T10:00:31.000000000Z" /> <EventRecordID>1150222</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>computername.network.com</Computer> <Security /> </System> <EventData> <Data Name="Username">username@network</Data> <Binary>6A0000C0</Binary> </EventData> </Event> This event was soon followed by this event. Log Name: System Source: LsaSrv Date: 10/22/2010 5:00:32 AM Event ID: 40960 Task Category: None Level: Warning Keywords: User: SYSTEM Computer: computername.network.com Description: The Security System detected an authentication error for the server cifs/storage.network.com. The failure code from authentication protocol Kerberos was "The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested. (0xc0000234)". Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="LsaSrv" Guid="{199FE037-2B82-40A9-82AC-E1D46C792B99}" /> <EventID>40960</EventID> <Version>0</Version> <Level>3</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x8000000000000000</Keywords> <TimeCreated SystemTime="2010-10-22T10:00:32.192035600Z" /> <EventRecordID>1150223</EventRecordID> <Correlation /> <Execution ProcessID="544" ThreadID="5464" /> <Channel>System</Channel> <Computer>computername.network.com</Computer> <Security UserID="S-1-5-18" /> </System> <EventData> <Data Name="Target">cifs/storage.network.com</Data> <Data Name="Protocol">Kerberos</Data> <Data Name="Error">"The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested. (0xc0000234)"</Data> </EventData> </Event> We are at wits end. we cannot re-image our machine, as it will take many days to get all our tools reinstalled and configured. We tried everything on the forums about this issue. and still nothing.This feels like a win 7 bug. If anyone can help up solve this issue , it will be greatly appreciated. Thanks Victor Selvaraj
October 23rd, 2010 5:59pm

Hi, I found this sentence “The login attempts occur at 5:00 am in the morning every day.” This is strange. Which operation would affect account at that time? How about other accounts? In addition, you could use the account lockout tools to troubleshoot this problem, please refer to: Account Lockout Tools Regards, Alex ZhaoPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
October 28th, 2010 2:08pm

Hi Alex, Since last week, the lockout has been happening at random times. Its not consistent anymore. Another Engineer in my team is also having the same Issue . We have exhausted almost all the places we could look for possible tasks or processes. But we could find nothing. My computer continues to lock me out .unless I power it down every night. Any help with this is greatly appreciated. Victor Victor Selvaraj
October 28th, 2010 6:42pm

I've run into the same problem. It tends to happen overnight if I leave my computer on but it's not consistently at the same time and will happen during the day as well. My credential manager is completely empty, no services or tasks are running under my user id. This all started after I changed my active directory password last month. Any chance anyone has discovered a solution for this? I'm having no luck with searching.
Free Windows Admin Tool Kit Click here and download it now
January 14th, 2011 5:57pm

Microsoft Support found the problem for us. Our domain accounts were locking when a Windows 7 computer was started. The Windows 7 computer had a hidden old password from that domain account. There are passwords that can be stored in the SYSTEM context that can't be seen in the normal Credential Manager view. Download PsExec.exe from http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx and copy it to C:\Windows\System32 . From a command prompt run: psexec -i -s -d cmd.exe From the new DOS window run: rundll32 keymgr.dll,KRShowKeyMgr Remove any items that appear in the list of Stored User Names and Passwords. Restart the computer.
January 22nd, 2011 12:36am

This worked for us! Almost four months of struggling with this. Thank you so much!!
Free Windows Admin Tool Kit Click here and download it now
May 10th, 2011 11:12pm

I have the same problem. I tried the suggested solution, however there were no stored passwords. Any other ideas?
September 9th, 2011 3:45pm

I used the same approach, but still doing the lockout. Microsoft Support found the problem for us. Our domain accounts were locking when a Windows 7 computer was started. The Windows 7 computer had a hidden old password from that domain account. There are passwords that can be stored in the SYSTEM context that can't be seen in the normal Credential Manager view. Download PsExec.exe from http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx and copy it to C:\Windows\System32 . From a command prompt run: psexec -i -s -d cmd.exe From the new DOS window run: rundll32 keymgr.dll,KRShowKeyMgr Remove any items that appear in the list of Stored User Names and Passwords. Restart the computer.
Free Windows Admin Tool Kit Click here and download it now
September 13th, 2011 3:35pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics