twig123 Posted May 27, 2007 Posted May 27, 2007 (edited) @twig: you have a usb device plugged in?Nope, the only thing that I have plugged into USB is my Microsoft Optical Mouse.... no usb drives.I haven't tried to access the Admin account with CTRL ALT DEL, however... none of the other accounts that have password will accept the passwords... but next time this happens I will try. (Hasn't happened in a while because I've been actually shutting down my system lately. However, I would normally leave it on for weeks at a time)...And that is a no for me as well on the Vista Pack....~Dave Edited May 27, 2007 by twig123
graysky Posted May 27, 2007 Author Posted May 27, 2007 More information. When I check in my event viewer>security I get: failure audit logged just when I tried to log-back in after a lockout:Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: myuseraccount Source Workstation: myPCNAME Error Code: 0xC000006AFor more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Here is the info from that url:Details Product: Windows Operating System ID: 680 Source: Security Version: 5.2 Symbolic Name: SE_AUDITID_ACCOUNT_LOGON Message: Logon attempt by: %1Logon account: %2Source Workstation: %3Error Code: %4Explanation A set of credentials was passed to the authentication system on this computer either by a local process or by a remote process or user. Success or failure is displayed in the message. If this event indicates success, then the credentials presented were valid. The error code is 0x0 for success messages. For failure messages, the user field in the message header displays NT AUTHORITY\SYSTEM, and an NTStatus code is displayed. The following is a list of the most common failure status codes and their meanings. NT Status Code Meaning 0xC000006A An incorrect password was supplied. 0xC000006F The account is not allowed to log on at this time. 0xC0000064 The account does not exist. 0xC0000070 The account is not allowed to log on from this computer. 0xC0000071 The password has expired. 0xC0000072 The account is disabled. User Action No user action is required.Version: 5.0 Symbolic Name: SE_AUDITID_ACCOUNT_LOGON Message: Logon attempt by: %1Logon account: %2Source Workstation: %3Error Code: %4Explanation A set of credentials was passed to the authentication system on this computer either by a local process or by a remote process or user. Success or failure is displayed in the message. If this event indicates success, then the credentials presented were valid. The error code is 0x0 for success messages. For failure messages, the user field in the message header displays NT AUTHORITY\SYSTEM, and an NTStatus code is displayed. The following is a list of the most common failure status codes and their meanings. NT Status Code Meaning 0xC000006A An incorrect password was supplied. 0xC000006F The account is not allowed to log on at this time. 0xC0000064 The account does not exist. 0xC0000070 The account is not allowed to log on from this computer. 0xC0000071 The password has expired. 0xC0000072 The account is disabled. User Action No user action is required.-------------------------------------------------------------------------------- Related Knowledge Base articles You can find additional information on this topic in the following Microsoft Knowledge Base articles: • Microsoft Security Center Find information, answers to your questions, instructions, the latest downloads, and more on the Blaster worm. • Failure Events Are Logged When the Welcome Screen Is Enabled With the welcome screen and logon/logoff and/or account logon success and failure auditing are enabled, pairs of Logon/Logoff failure or Account Logon failure audits with successful logon audit entries are added to the computer security log. The... • A message stating that an instance of SQL Server is vulnerable to virus attacks is logged in the application event log when you install SQL Server 2000 or MSDE 2000 on a computer that is running Windows XP Service Pack 2 When you install SQL Server 2000 SP2 or MSDE 2000 SP2 or earlier versions on computers that are running Windows XP SP2, you must install the latest SQL Server 2000 service pack or the latest MSDE 2000 service pack to help protect your computer.
graysky Posted June 6, 2007 Author Posted June 6, 2007 Finally fixed this by reinstalling the o/s... Knocking on wood that it doesn't return. Must be a microsoft "feature"
twig123 Posted June 7, 2007 Posted June 7, 2007 Finally fixed this by reinstalling the o/s... Knocking on wood that it doesn't return. Must be a microsoft "feature" Sure, I could have told you that reinstalling the OS would resolve this... but were you able to every find out how to resolve the issue on the current Install of the OS, without having to go through such drastic measures as a reinstall?~Dave
graysky Posted June 8, 2007 Author Posted June 8, 2007 @twig: not at all. It was really starting to get on my nerves. There is only hit-or-miss info out there with no definitive answer... is your system still doing it?
twig123 Posted June 8, 2007 Posted June 8, 2007 @twig: not at all. It was really starting to get on my nerves. There is only hit-or-miss info out there with no definitive answer... is your system still doing it?Hmm... Well it hasn't done it to me in a little while, but it is so sporadic it is hard to predict and I'm not able to foresee when the issue will arise...I wish there were more than just you and I having this issue that we could talk to.... but *sigh* I'll keep hunting... until i decide I'm done trying to fix little thing after little thing, and just reformat again...~Dave
cluberti Posted June 9, 2007 Posted June 9, 2007 Finally fixed this by reinstalling the o/s... Knocking on wood that it doesn't return. Must be a microsoft "feature" Usually this occurs when a user is unable to unload their profile, and thus the user stays "logged on" because the logout did not completely finish. You can see if this is the case by looking at the system remotely using TS admin or pslist, and you're likely to see two users fully logged on, or possibly one fully logged on with another "orphaned" profile with only winlogon and a few other processes listed. Since a Windows desktop OS cannot have more than one active logon session, the second logon does not work. The bogus password error I do not understand, although it is possible that there is some problem with winlogon or schannel on the box causing the error once the problem state is reached.The best "fix" for this is to make sure you aren't using bad antivirus or printer software/drivers that leave file or registry handles open, or do not clean up pointers to handles when a user issues a logout request, and also to have the latest release version of UPHClean installed on the box to make sure registry handles are cleaned up for sure on logout (it won't kill file handles or pointers to file handles, as that could corrupt files - that might keep profiles loaded, but at least files won't go bad due to logging out).
SngBrdb Posted June 30, 2007 Posted June 30, 2007 I know this is an older thread, but for the benefit of anyone else beating their head against this, I'll say that I've experienced it, too. Enough people have experienced this that MS should be looking at it... it is damned annoying! I don't have a non-pw account, and I'm forced to power cycle the machine. Cluberti is right, it definitely seems related to problems logging off, and only when I Winkey+L, not when I fully log off. It hasn't happened to me in a while :knock:, but I've no doubt it will. That and the video not coming back after the monitor power-saves A while back, I did install MS 'User Profile Hive Cleanup', which was recommended because some apps generated event log warnings that the account could not be logged off because a service was running with the logged-on user's credentials (thanks once again, HP). Currently the Hive Cleanup service is not running, and set to manual... what I don't recall is whether the issue started before I installed this, after I installed, or went away when I installed. I also run SpeedFan, which you mentioned... for a while there it wouldn't shut down at logoff, and would have to be forcibly terminated. I think that was why I turned off the Hive Cleanup, because that issue only started after I installed HC.I've read articles claiming that a maximum number (3??) of switch-user logoffs caused this, but that hasn't meshed with what I see. All I know is that I'm sick of forcibly rebooting... lovely disk errors, etc.Anyone who is experiencing this, please throw your two cents in... when you've seen it, culprits you've identified, etc. I would love to nail this one down.
gamehead200 Posted July 1, 2007 Posted July 1, 2007 A while back, I did install MS 'User Profile Hive Cleanup', which was recommended because some apps generated event log warnings that the account could not be logged off because a service was running with the logged-on user's credentials (thanks once again, HP). Currently the Hive Cleanup service is not running, and set to manual... what I don't recall is whether the issue started before I installed this, after I installed, or went away when I installed. I'm pretty sure it has nothing to do with this. I just did a fresh install and installed it and haven't had a single problem with WinKey+L, logging off, or anything as of yet. It's been a little more than a week that I reinstalled XP.
spacesurfer Posted July 2, 2007 Posted July 2, 2007 (edited) I've also been locked out on my laptop with 3 users but with a difference scenario.What happens to me is after the system logs off for inactivity, when I try to click on my profile to enter the password to log back in, it won't work! I cannot get the cursor in the password field box. It's happened several times.However, on a computer with a different logon GUI (logongui.exe), this does not happen. So, I wonder if it's a problem with MS's own lo logongui.exe??Oh yeah, it happened on my Uncles's desktop too, when I was at his house... he has like 3 users with one being a guest account. I tried to get into his profile (I was just playing around with passwords) to see if I could guess his password but it wouldn't let me in the password field. The only remedy is to restart the computer at this point. Edited July 2, 2007 by spacesurfer
graysky Posted July 30, 2007 Author Posted July 30, 2007 Man, I'm going crazy with this... out of the blue, the system is doing this again!I spent the past few hours googling around but came up with nothing... anyone?
tbs Posted July 30, 2007 Posted July 30, 2007 I'm with spacesurfer on this, I had logon problems, could not even type a password sometimes!There is a work-around of sorts posted at RyanVM's site. I rename logonui.exe and change a reg key, (see second from last post in link). I have no idea what is going on but I've stopped pulling my hair out!Hope it helps some, tbs
jcarle Posted July 30, 2007 Posted July 30, 2007 UPHClean is always a good thing to have installed. And cluberti is 100% on the money, as usual.
graysky Posted July 31, 2007 Author Posted July 31, 2007 Thanks for the replies.... I'll give User Profile Hive Cleanup Service a try.
Tarun Posted July 31, 2007 Posted July 31, 2007 For those interested, here's a direct link to UPHClean.I definitely recommend using it, and even distribute it with my Anti-Malware packs. It's even helped me out a few times.
Recommended Posts
Please sign in to comment
You will be able to leave a comment after signing in
Sign In Now