MonitorWare Knowledge Base

Hi. I am experiencing something peculiar with user accounts.

Sometimes an account is locked out, then a little while later it appears
unlocked again. However, no 671 "unlock" event is recorded in the event logs at all. There is no policy set to automatically unlock user accounts after a certain time - all unlocks must be performed manually, however it appears either that accounts are being unlocked without intervention, or the accounts are being unlocked but the event is not recorded. Why would this be the case?

This is a mixed-mode 2003/2000 domain with 2003 on all domain controllers

This is actually due to a logging failure on 1 of the 4 domain controllers. All the account unlocks that have no 671 associated came from the same machine which has since been discovered not to be working properly.