[ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- From: James Chong <jchong@xxxxxxxxxxxxxx>
- To: "exchangelist@xxxxxxxxxxxxx" <exchangelist@xxxxxxxxxxxxx>
- Date: Sat, 13 Sep 2008 10:44:05 -0400
|
Sorry typo copied and pasted same error code for both in previous email mean; "You
want to look for logs showing failed attempts 0xC000006A (Incorrect PW) followed by a lock out
0xC0000234"
James Chong
Sr. Systems Engineer
Simplexity, LLC.
11130 Sunrise Valley Drive, Suite 300
Reston, VA 20191
O (703) 657-4612
C (703) 863-1483
From: James Chong Sent: Saturday, September 13, 2008 10:38 AM To: exchangelist@xxxxxxxxxxxxx Subject: RE: [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE) Reset what his account? You mean his account shows it’s locked in the account tab? If so; do you have a password lock out domain policy? If so; you will need to identify what is impersonating his account. From my experience it’s two sources. You will need to parse through your event viewer logs on all your DCs. You can use a utility called eventcomb to search all of them for you. It’s in a free Microsoft suite called secops; you can google and download.
You want to look for logs showing failed attempts 0xC000006A (Incorrect PW) followed by a lock out (0xC000006A).
1. User has stale terminal server session that never logged off and is using his old credentials 2. User’s own computer is running some processes.
1. Any services running as user’s account (type msconfig in start menu; go to services) 2. Any scheduled tasks. Start; programs; accessories; system tools; scheduled tasks 3. Is IIS installed on his workstation? Start run; type inetmgr; expand default website; properties; click directory security tab; click edit for anonymous access and authentication control. Is this running with your account? 4. Any run As Shortcuts 5. Any processes running during startup type msconfig in start menu; go to startup tab; do you recognize any processes that may be running as your account? 6. Double check stored passwords. Go to start run type rundll32.exe keymgr.dll, KRShowKeyMgr
James Chong
Sr. Systems Engineer
Simplexity, LLC.
11130 Sunrise Valley Drive, Suite 300
Reston, VA 20191
O (703) 657-4612
C (703) 863-1483
From: exchangelist-bounce@xxxxxxxxxxxxx [exchangelist-bounce@xxxxxxxxxxxxx] On Behalf Of Kingsford Boateng [kingboat10@xxxxxxxxx] Sent: Friday, September 12, 2008 11:38 AM To: exchangelist@xxxxxxxxxxxxx Subject: [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
|
- References:
- [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- From: James Chong
- [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- From: Kingsford Boateng
- [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- From: James Chong
- [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
Other related posts:
- » [ExchangeList] Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)
- » [ExchangeList] Re: Moving Mailbox from Crashed server (BE) to healthy Server (BE)