We have had 3 machines locked out when accessing JPG files. The outcome of viewing the jpgs is that our domain controller wont let us access its resources for 2 hours, after the 2 hours is up, we can then access the resources again.

The message says :

\\server\redirectedfolders\username\desktop is not accessible.  you might not have permission to use this network resource.  Contact the administrator of this server to find out if you have access permissions.

Logon failure: account currently disabled

I've looked at the event viewer and cant find any related events. Does anyone know what will be locking the client from accessing server resources?

The client is windows 7 and the server is windows 2008 SBS.

  • 1
    are you getting the error when accessing JPG's that are not in a redirected folder or from a user account without a roaming profile? – Somantra Jun 28 '12 at 16:40
  • 1
    Have a look here for some tools to help discover what is locking an account serverfault.com/a/65271/1054 – squillman Jun 28 '12 at 18:02
  • @resolver101, you mention '3 machines locked out', do you mean that any user account that logs into one of the three machines will generate the error? – Somantra Jun 28 '12 at 18:08
  • After we have accessed the jpg using Zune, the user goes back to the desktop (which is folder redirected) and we receive the message above. we dont use roaming profiles – resolver101 Jun 29 '12 at 8:16
  • 3 separate users each with there own machine (Different makes) and accessing the pictures from windows phone + digital camera. – resolver101 Jun 29 '12 at 8:17

That error message seems to indicate that the accounts have gotten locked out by something else, and as a result, aren't able to access network resources that require AD authentication.

The most common causes of account lockouts, other than dumb users who type in the wrong username or password several times in a row, in my experience, are network mappings (drives, printers) using an old password that has since been changed. With Windows 7, you can check the credential manager, and/or use a lockout tracing tool. I use this one, from MS - run it on your Domain Controller, and it will point you at the bad password count and time for a queried user account, allowing you to go through the logs and find the responsible computer. (Assuming you have the proper log settings, if not enable auditing level logging for Security events.) From there it's usually trivial to see what cached credentials or user action is causing the lockout.

You might also want to look into why you've got a 2 hour lockout expiry period. Seems quite high.

| improve this answer | |
  • Thanks, I've downloaded the software and brought up the machine/user in question but no details. Any recommendations for proper log settings. – resolver101 Jun 29 '12 at 8:32
  • MS recommendations for log settings to trace lockouts: technet.microsoft.com/en-us/library/cc776964%28WS.10%29.aspx – HopelessN00b Jun 29 '12 at 12:19
  • sorry for the delay, im just getting around to implementing the logging. The document refers to Windows Server 2003, is there a specific windows 2008 version? – resolver101 Jul 3 '12 at 15:15
  • I don't know; I've used that tool and document successfully on 2008 R2 DCs/forests. It may be one of those MS documents that didn't get updated with the new version because the steps didn't change between 2003 and 2008. (I've seen that a lot with SQL 2005 documentation applying to SQL 2008 and Exchange 2007 documentation applying to Exchange 2010) – HopelessN00b Jul 3 '12 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.