A sysadmin asked me to investigate this error. One user has had her AD locked out every evening and when the sysadmin followed up with MS, they pointed to Unity Connection due its address being listed in the 'source network address' field in this log entry. I've always tried to stay as far away from AD as I could which is biting me now. It seems highly unlikely that UC would be locking out a single user account each night, but I don't know how to confirm that. Ideally, I'd like to assist the sysadmin by pinpointing the real problem, but will settle for being able to confirm that it's not UC.
Any ideas?
An account failed to log on.
Subject:
Security ID: SYSTEM
Account Name: [dc$ - not sure what the $ represents]
Account Domain: [domain]
Logon ID: 0x3e7
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: [userid]
Account Domain: [domain]
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc000006a
Process Information:
Caller Process ID: 0x240
Caller Process Name: C:\Windows\System32\lsass.exe
Network Information:
Workstation Name: [primary dc]
Source Network Address: [unity connection]
Source Port: 57750
Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
