Jump to content

I get locked out of windows (welcome screen)


graysky

Recommended Posts

@twig: you have a usb device plugged in?

Nope, the only thing that I have plugged into USB is my Microsoft Optical Mouse.... no usb drives.

I haven't tried to access the Admin account with CTRL ALT DEL, however... none of the other accounts that have password will accept the passwords... but next time this happens I will try. (Hasn't happened in a while because I've been actually shutting down my system lately. However, I would normally leave it on for weeks at a time)

...And that is a no for me as well on the Vista Pack....

~Dave

Edited by twig123
Link to comment
Share on other sites


More information. When I check in my event viewer>security I get: failure audit logged just when I tried to log-back in after a lockout:

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: myuseraccount
Source Workstation: myPCNAME
Error Code: 0xC000006A


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Here is the info from that url:

Details 
Product: Windows Operating System
ID: 680
Source: Security
Version: 5.2
Symbolic Name: SE_AUDITID_ACCOUNT_LOGON
Message: Logon attempt by: %1
Logon account: %2
Source Workstation: %3
Error Code: %4


Explanation
A set of credentials was passed to the authentication system on this computer either by a local process or by a remote process or user.

Success or failure is displayed in the message. If this event indicates success, then the credentials presented were valid. The error code is 0x0 for success messages. For failure messages, the user field in the message header displays NT AUTHORITY\SYSTEM, and an NTStatus code is displayed. The following is a list of the most common failure status codes and their meanings. NT Status Code Meaning
0xC000006A An incorrect password was supplied.
0xC000006F The account is not allowed to log on at this time.
0xC0000064 The account does not exist.
0xC0000070 The account is not allowed to log on from this computer.
0xC0000071 The password has expired.
0xC0000072 The account is disabled.



User Action
No user action is required.



Version: 5.0
Symbolic Name: SE_AUDITID_ACCOUNT_LOGON
Message: Logon attempt by: %1
Logon account: %2
Source Workstation: %3
Error Code: %4


Explanation
A set of credentials was passed to the authentication system on this computer either by a local process or by a remote process or user.

Success or failure is displayed in the message. If this event indicates success, then the credentials presented were valid. The error code is 0x0 for success messages. For failure messages, the user field in the message header displays NT AUTHORITY\SYSTEM, and an NTStatus code is displayed. The following is a list of the most common failure status codes and their meanings. NT Status Code Meaning
0xC000006A An incorrect password was supplied.
0xC000006F The account is not allowed to log on at this time.
0xC0000064 The account does not exist.
0xC0000070 The account is not allowed to log on from this computer.
0xC0000071 The password has expired.
0xC0000072 The account is disabled.



User Action
No user action is required.



--------------------------------------------------------------------------------

Related Knowledge Base articles
You can find additional information on this topic in the following Microsoft Knowledge Base articles:
• Microsoft Security Center
Find information, answers to your questions, instructions, the latest downloads, and more on the Blaster worm.
• Failure Events Are Logged When the Welcome Screen Is Enabled
With the welcome screen and logon/logoff and/or account logon success and failure auditing are enabled, pairs of Logon/Logoff failure or Account Logon failure audits with successful logon audit entries are added to the computer security log. The...
• A message stating that an instance of SQL Server is vulnerable to virus attacks is logged in the application event log when you install SQL Server 2000 or MSDE 2000 on a computer that is running Windows XP Service Pack 2
When you install SQL Server 2000 SP2 or MSDE 2000 SP2 or earlier versions on computers that are running Windows XP SP2, you must install the latest SQL Server 2000 service pack or the latest MSDE 2000 service pack to help protect your computer.

Link to comment
Share on other sites

  • 2 weeks later...
Finally fixed this by reinstalling the o/s... Knocking on wood that it doesn't return. Must be a microsoft "feature" :)

Sure, I could have told you that reinstalling the OS would resolve this... but were you able to every find out how to resolve the issue on the current Install of the OS, without having to go through such drastic measures as a reinstall?

~Dave

Link to comment
Share on other sites

@twig: not at all. It was really starting to get on my nerves. There is only hit-or-miss info out there with no definitive answer... is your system still doing it?

Hmm... Well it hasn't done it to me in a little while, but it is so sporadic it is hard to predict and I'm not able to foresee when the issue will arise...

I wish there were more than just you and I having this issue that we could talk to.... but *sigh* I'll keep hunting... until i decide I'm done trying to fix little thing after little thing, and just reformat again...

~Dave

Link to comment
Share on other sites

Finally fixed this by reinstalling the o/s... Knocking on wood that it doesn't return. Must be a microsoft "feature" :)

Usually this occurs when a user is unable to unload their profile, and thus the user stays "logged on" because the logout did not completely finish. You can see if this is the case by looking at the system remotely using TS admin or pslist, and you're likely to see two users fully logged on, or possibly one fully logged on with another "orphaned" profile with only winlogon and a few other processes listed. Since a Windows desktop OS cannot have more than one active logon session, the second logon does not work. The bogus password error I do not understand, although it is possible that there is some problem with winlogon or schannel on the box causing the error once the problem state is reached.

The best "fix" for this is to make sure you aren't using bad antivirus or printer software/drivers that leave file or registry handles open, or do not clean up pointers to handles when a user issues a logout request, and also to have the latest release version of UPHClean installed on the box to make sure registry handles are cleaned up for sure on logout (it won't kill file handles or pointers to file handles, as that could corrupt files - that might keep profiles loaded, but at least files won't go bad due to logging out).

Link to comment
Share on other sites

  • 3 weeks later...

I know this is an older thread, but for the benefit of anyone else beating their head against this, I'll say that I've experienced it, too. Enough people have experienced this that MS should be looking at it... it is damned annoying! I don't have a non-pw account, and I'm forced to power cycle the machine.

:realmad:

Cluberti is right, it definitely seems related to problems logging off, and only when I Winkey+L, not when I fully log off. It hasn't happened to me in a while :knock:, but I've no doubt it will. That and the video not coming back after the monitor power-saves <_<

A while back, I did install MS 'User Profile Hive Cleanup', which was recommended because some apps generated event log warnings that the account could not be logged off because a service was running with the logged-on user's credentials (thanks once again, HP). Currently the Hive Cleanup service is not running, and set to manual... what I don't recall is whether the issue started before I installed this, after I installed, or went away when I installed. :rolleyes:

I also run SpeedFan, which you mentioned... for a while there it wouldn't shut down at logoff, and would have to be forcibly terminated. I think that was why I turned off the Hive Cleanup, because that issue only started after I installed HC.

I've read articles claiming that a maximum number (3??) of switch-user logoffs caused this, but that hasn't meshed with what I see. All I know is that I'm sick of forcibly rebooting... lovely disk errors, etc.

Anyone who is experiencing this, please throw your two cents in... when you've seen it, culprits you've identified, etc. I would love to nail this one down.

Link to comment
Share on other sites

A while back, I did install MS 'User Profile Hive Cleanup', which was recommended because some apps generated event log warnings that the account could not be logged off because a service was running with the logged-on user's credentials (thanks once again, HP). Currently the Hive Cleanup service is not running, and set to manual... what I don't recall is whether the issue started before I installed this, after I installed, or went away when I installed. :rolleyes:

I'm pretty sure it has nothing to do with this. I just did a fresh install and installed it and haven't had a single problem with WinKey+L, logging off, or anything as of yet. It's been a little more than a week that I reinstalled XP.

Link to comment
Share on other sites

I've also been locked out on my laptop with 3 users but with a difference scenario.

What happens to me is after the system logs off for inactivity, when I try to click on my profile to enter the password to log back in, it won't work! I cannot get the cursor in the password field box. It's happened several times.

However, on a computer with a different logon GUI (logongui.exe), this does not happen.

So, I wonder if it's a problem with MS's own lo logongui.exe??

Oh yeah, it happened on my Uncles's desktop too, when I was at his house... he has like 3 users with one being a guest account. I tried to get into his profile (I was just playing around with passwords) to see if I could guess his password but it wouldn't let me in the password field. The only remedy is to restart the computer at this point.

Edited by spacesurfer
Link to comment
Share on other sites

  • 4 weeks later...

I'm with spacesurfer on this, I had logon problems, could not even type a password sometimes!

There is a work-around of sorts posted at RyanVM's site. I rename logonui.exe and change a reg key, (see second from last post in link). I have no idea what is going on but I've stopped pulling my hair out!

Hope it helps some, tbs

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...