Results 1 to 5 of 5
  1. #1
    Star Lounger
    Join Date
    Apr 2002
    Posts
    78
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Auto logon of account

    Hi folks,
    I've got a client with an NT 4.0 PDC and NT4 network. We recently set up time restrictions for the secretaries' accounts to prevent after-hours access. One of the users has frequently left her computer on after leaving the office. In the security log, I see logon attempts with this user's name happening every two hours to the minute throughout the night, which dutifully get repulsed by the logon restriction. When 7:00 am rolls around, the next logon attempt is successful.

    I have searched the computer for suspicious files & processes and can't find any off-hand. Does anyone know what this is? Is it a standard process that just tries to refresh, like a browser query/broadcast or something like that?

    I appreciate any help that you can give.

    Thanks,

    Charlie T.

  2. #2
    Plutonium Lounger Leif's Avatar
    Join Date
    Dec 2000
    Location
    U.K.
    Posts
    14,010
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Auto logon of account

    What OS is the user running? If it is NT / W2K the event log may give a clue.

    Otherwise, are you using DHCP? If the lease duration is set to two hours, the users machine may be trying for a new IP address at that interval.

  3. #3
    Star Lounger
    Join Date
    Apr 2002
    Posts
    78
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Auto logon of account

    She's running NT4.

    There is a DHCP server on the network, but it's set to renew after 2000 minutes (33 hrs and change).

    The Event Log (on the server) only indicates that the username was not permitted to log on because of access restriction, so not much help there. The workstation's security log is empty.

    Any other ideas?

    Charlie T.

  4. #4
    Plutonium Lounger Leif's Avatar
    Join Date
    Dec 2000
    Location
    U.K.
    Posts
    14,010
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Auto logon of account

    Only other thoughts...
    Outlook checking for new mail on the server
    IE checking for updates (though that sounds too frequent)
    If the timing is that accurate, can you see anything in any logs occuring (exactly 2 hours before) while the user has permission to connect prior to the cut-off time?

    What programs / services running on the workstation?
    Clock synchronization?
    Any office application set to auto-save?

  5. #5
    Star Lounger
    Join Date
    Apr 2002
    Posts
    78
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Auto logon of account

    The only likely possibility among those you mentioned would be MS Word trying to do auto-save. I'll have to check that out the next time I'm in. If you like, I'll post a list of running processes also when I get a chance.

    Thanks.
    Charlie T.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •