Analysis of the solution for intranet users ' ad account not landing

Recently, some users of the company have reported problems with the pop-up password box and the inability to log on when using company-related Microsoft systems (including Microsoft Share Point 2010, Microsoft Outlook 2010, Lync) (see Figure 1). Under normal circumstances, users only need to log on to the system, they do not have to re-enter the user name and password to access these ad-based applications.

I. Analysis of the phenomenon

By grasping the packet analysis and combining with the Lockoutstatus tools provided by Microsoft, we found that this problem was caused by a number of failed landings on a machine unrelated to the user's PC (or server), causing the accounts to be locked in the domain (based on corporate AD (Active directory, Active Directory) security policy, 5 consecutive password logon failure, ad account will be locked for 5-10 minutes, this according to the ad policy settings will be different, as shown in Figure 2.

Figure 1

Figure 2

Second, the reason analysis

The virus scan determines that the account is locked by "W32." Downadup.b "virus causes. After analysis, W32. DOWNADUP.B can be propagated using remote code execution vulnerabilities for Microsoft Windows Server service RPC (remote Procedure call, remoted procedure calls), or use a password dictionary to guess the user's password. Connect to an infection with a weak password-protected network share. Viruses can cause the following problems:

(1) Prevent infected computers from accessing certain Web sites (such as the Security Update Web site), thus preventing virus threats from being removed;

(2) because the virus automatically uses the password to attempt to use the local area network resources, causes the partial ad account not to lock normally.

Third, virus prevention methods

To prevent w32.downadup.b virus need to install the Microsoft Official patch ms08-067, see: Http://www.microsoft.com/security/pc-security/conficker.aspx. Combined with the latest virus library, all servers have been fully scanned. Found that there is an account lockout situation, immediately notify it's administrator to unlock the account to avoid the resulting problem.

This article is from the "excellent once in a while" blog, please be sure to keep this source http://patterson.blog.51cto.com/1060257/793308