I have a Windows 7 laptop (domain member), and when I connect a VPN to the office, within 5-10 minutes the main file server/domain controller reports a failed logon for the user account, then 3, then 5, then the user account locks.
It happens with no extra software running, so it's not an Outlook problem, for instance.
I have been through control panel and cleared out the Windows and .Net password cache. There are no mapped printers, there is a mapped drive but it appears to work, and there are no scheduled tasks I can find which run so often. I have reset the user's password and put the new one on the laptop.
I have also put Wireshark on the laptop, but all that can see is "encrypted traffic" going over the VPN.
A friend has said there are issues with Windows 7 and Windows 2003 Server, e.g. with the LM hash settings which needs a hotfix. He was quite vague and there's another user with Windows 7 for whom this doesn't happen.
My suspicion is that it's Windows doing this, not a third party installed program.... but how can I dig into this further and find what's causing it?
****Update: I have disconnected the mapped drive, and the problem still happened - 4 login failures within two minutes of connecting the VPN to the office.
Event logs on the server shows Source: Security, Category: Account Logon, ID 675, Pre-authentication failed. Username: (computer-name)$, Service Name: krbtgt/domain.fqdn.example.org, failure code: 0x19
Followed by Event Security / 680 / Account Logon, MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 / Error Code: 0xC000006A Account logoff / Unknown user name or bad password (both repeat 4 times)
I think I have it - the VPN username is the same as the Windows account username, but the passwords are different (because the VPN connects to a firewall, not a Windows server), however when accessing network resources Windows seems to be trying the VPN credentials first - because the account name is the same, the password failures cause the Windows account to become locked.
I've changed it so the VPN uses a different username and in a few minutes of testing, that seems to workaround it at least.
Would be interested if anyone knows why the (Windows 7 PPTP) VPN might behave like this and if there's an official way to stop it.