Logon Failure: Account locked out

	Home \| Site Map \| How To \| Windows Vista \| Case Studies \| Articles \| Forums \| Services \| Donations \| Careers \| About Us \| Contact Us\|

Event ID 539 - Logon Failure: Account locked out

Windows Logon Types

Symptoms: The server Event Viewer lists Event ID 539: Logon Failure:
Reason: Account locked out
User Name: <blin>
Domain: <chicagotech.net>
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: <msmvp1>

Cause: A user tried to log on to the system using an account that is locked out. A large number of these events logged in Event Viewer usually indicate that a service account password is configured incorrectly or a program password does not match the password on the server.

Note: The Logon Types are:
Type 2 : Console logon - interactive from the computer console.
Type 3 : Network logon - network mapping (net use/net view).
Type 4 : Batch logon - scheduler.
Type 5 : Service logon - service uses an account.
Type 7 : Unlock Workstation.
Type 8: NetworkCleartext - Logon with credentials sent in the clear text, for example logon to IIS with the basic authentication.
Type 9: NewCredentials.
Type 10: RemoteInteractive - Logon remotely such as Terminal Services, Remote Desktop or Remote Assistance.
Type 11: CachedInteractive - Logon with cached credentials, for example logon a work laptop at home or using VPN)
Type 0 & 1 are not used and Type 6 is listed as a proxy.

Case 1: One windows 98 computer uses auto-logon feature. Since the user has changed his password, the computer can’t logon and generates the Event ID 539 on the server.

Case 2: When a user log on to Outlook from an untrusted domain, the Outlook client domain account is locked out.

Troubleshooting Tool: Microsoft Technical Support includes a track account lockout tool called Netlogon.dll. With the Netlogon.dll, you can track bad password attempts easily.