Hi,
By default, you can't lockout Administrator, but you can use passprop tool
from Resource Kit to enable locking out for built-in Administrator account.
In Windows 2000 you can only lock it out from remote logons while in 2003
you can lock it out even from interactive logons.
Here is more
http://www.microsoft.com/technet/sec.../aapgch03.mspx
*************************************************
Enable Account Lockout for Remote Administrator Logons
One way to prevent attackers from using the built-in administrator account
and password credentials is to allow the administrator account to be locked
out of the network by an account policy, after a specified number of logon
failures occur. By default, the built-in administrator account cannot be
locked out; however, you can use passprop.exe, a command-line program in the
Microsoft Windows 2000 Server Resource Kit, to enable account lockout for
remote logons that use the administrator account. When you run the passprop
utility with the /ADMINLOCKOUT switch, you make the administrator account
subject to account lockout policies. In Windows 2000 Server, this only
applies to remote logons, and because the built-in administrator account can
never be locked out from the local computer, this program allows you to
protect the administrator account from attack over the network but still
allows interactive access.
Warning: In Windows Server 2003, passprop will allow the built-in
administrator account to get locked out from interactive logons as well as
remote logons.
*************************************************
--
Mike
Microsoft MVP - Windows Security
"Phillip Windell" <@.> wrote in message
news:%23%(E-Mail Removed)...
>I did not think the original built in Administrator Accout could even get
> locked out,...I thought it was the one exception to the lockout policy.
>
> --
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
> -----------------------------------------------------
> Understanding the ISA 2004 Access Rule Processing
> http://www.isaserver.org/articles/IS...cessRules.html
>
> Microsoft Internet Security & Acceleration Server: Guidance
> http://www.microsoft.com/isaserver/t...dance/2004.asp
> http://www.microsoft.com/isaserver/t...dance/2000.asp
>
> Microsoft Internet Security & Acceleration Server: Partners
> http://www.microsoft.com/isaserver/partners/default.asp
> -----------------------------------------------------
>
>
>
> "Miha Pihler [MVP]" <mihap-(E-Mail Removed)> wrote in message
> news:%(E-Mail Removed)...
>> Hi,
>>
>> These tools should help you out determining what is causing the lockout
>>
>> Account Lockout and Management Tools
>>
> http://www.microsoft.com/downloads/d...displaylang=en
>>
>> --
>> Mike
>> Microsoft MVP - Windows Security
>>
>>
>> "Darren" <(E-Mail Removed)> wrote in message
>> news:ED2D93BE-FADC-4C8A-A4A4-(E-Mail Removed)...
>> > There is some process which keeps locking the admin account. Is there
>> > some
>> > tool on the market to help me find what is doing this. The event log
> only
>> > shows the following:
>> >
>> >
>> > Reason: Unknown user name or bad password
>> > User Name: Administrator
>> > Domain: @@@@@@@
>> > Logon Type: 4
>> > Logon Process: Advapi
>> > Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>> >
>> > I checked all the services passwords and they seem correct.
>> >
>> >
>> >
>>
>>
>
>
Similar Threads
Linear Mode
