any windows server admins?

[Nyper]

Having a small problem here....

Accounts are being locked out on a server due to too many invalid login attempts.

The thing is - the users aren't really trying to log in. Something on our laptop is doing it automatically and we can't figure out how to stop it!

From the security event log:

Logon Failure:
Reason: Unknown user name or bad password
User Name: bill.user
Domain:
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: BILLSLAPTOP

Note: We do not use Active Directory nor a domain controller. The OS is Windows 2000 Server.

It seems to only be happening on one machine, which happens to be our main web server.

Virus scans aren't showing anything. One person's laptop is trying to login every 5 minutes on the dot. Others are more random.

I have tried Googling the NtLmSsp and NTLM, but not having any luck resolving the issue. Anyone?

 

[Silverlord]

So your users log in locally and have access to a domain controller to use files? Or they go on internet explorer and use the web server interface?

 

[Nyper]

Sorry for the lack of explanation. We simply log in through remote desktop when we need access to the server (very limited # of users for this server). We are finding that when we try to log in, we are told our accounts are locked out. So we log in as Administrator, take a look at the logs... and that's what I posted above.

Thanks for your help.

 

[Silverlord]

Download network monitor and look for login events.. Also it will show you what connections are going into the server.

 

[superdave1984]

You might have a DOS attack going on.

 

[Nyper]

Have scanned our laptops with two or three different anti-virus & spyware programs. Nothing is showing up. It's really driving me bananas...

 

[Silverlord]

Hence download network monitor it will tell you what/who is doing this to your server

 

[Nyper]

Welp.. we're getting it narrowed down now.

The invalid login occurs everytime we try to check our email. This server is also our mail server.

It is happening to 3 of us here, and all 3 of us are running Outlook 2007. We all have different anti-virus software. We have disabled that and the problem still occurs.

Outlook is the devil...

Another employee is also running Outlook 2007 and NOT having this issue. What in the world.... ?

 

[Nyper]

New progress.

The reason it throws an invalid login in the event viewer for some users and not others is because....

For all users, their user name on the server (for remote desktop, etc) is the same as their user name for the mail server (POP3).

For some of us, the two passwords are different. For those of us who use different passwords, it throws an invalid login. Why the heck would that be related locking out the user account on the machine when we are only trying to check email? That's silly as ****!

 

[superdave1984]

Outlook is the devil...

Could be worse. We have to use Lotus Notes.