用域账号登录时 报以上错误；
说明 账号被锁定了；而且是频繁被锁定；
通常原因如下：
Common Causes for Account Lockouts
To avoid false lockouts, check each computer on which a lockout occurred for the following behaviors:
• Programs: Many programs cache credentials or keep active threads that retain the credentials after a user changes their password.
• Service accounts: Service account passwords are cached by the service
control manager on member computers that use the account as well as
domain controllers. If you reset the password for a service account and
you do not reset the password in the service control manager, account
lockouts for the service account occur. This is because the computers
that use this account typically retry logon authentication by using the
previous password. To determine whether this is occurring, look for a
pattern in the Netlogon log files and in the event log files on member
computers. You can then configure the service control manager to use the
new password and avoid future account lockouts.
• User logging on to multiple computers: A user may log onto multiple
computers at one time. Programs that are running on those computers may
access network resources with the user credentials of that user who is
currently logged on. If the user changes their password on one of the
computers, programs that are running on the other computers may continue
to use the original password. Because those programs authenticate when
they request access to network resources, the old password continues to
be used and the users account becomes locked out. To ensure that this
behavior does not occur, users should log off of all computers, change
the password from a single location, and then log off and back on.
• Stored user names and passwords retain redundant credentials: If any
of the saved credentials are the same as the logon credential, you
should delete those credentials. The credentials are redundant because
Windows tries the logon credentials when explicit credentials are not
found. To delete logon credentials, use the Stored User Names and
Passwords tool. For more information about Stored User Names and
Passwords, see online help in Windows XP and the Windows Server 2003
family.
• Scheduled tasks: Scheduled processes may be configured to using credentials that have expired.
• Persistent drive mappings: Persistent drives may have been
established with credentials that subsequently expired. If the user
types explicit credentials when they try to connect to a share, the
credential is not persistent unless it is explicitly saved by Stored
User Names and Passwords. Every time that the user logs off the network,
logs on to the network, or restarts the computer, the authentication
attempt fails when Windows attempts to restore the connection because
there are no stored credentials. To avoid this behavior, configure net
use so that is does not make persistent connections. To do this, at a
command prompt, type net use /persistent:no. Alternately, to ensure
current credentials are used for persistent drives, disconnect and
reconnect the persistent drive.
• Disconnected Terminal Server sessions: Disconnected Terminal Server
sessions may be running a process that accesses network resources with
outdated authentication information. A disconnected session can have the
same effect as a user with multiple interactive logons and cause
account lockout by using the outdated credentials. The only difference
between a disconnected session and a user who is logged onto multiple
computers is that the source of the lockout comes from a single computer
that is running Terminal Services.
• Service accounts: By default, most computer services are configured
to start in the security context of the Local System account. However,
you can manually configure a service to use a specific user account and
password. If you configure a service to start with a specific user
account and that accounts password is changed, the service logon
property must be updated with the new password or that service may lock
out the account.
• Account Lockout for Remote Connections: The account lockout feature that is discussed in this paper is independent of the account lockout feature for remote connections, such as in the Routing and Remote Access service and Microsoft Internet Information Services (IIS). These services and programs may provide their own unrelated account lockout features.
• Internet Information Services: By default, IIS uses a token-caching mechanism that locally caches user account authentication information. If lockouts are limited to users who try to gain access to Exchange mailboxes through Outlook Web Access and IIS, you can resolve the lockout by resetting the IIS token cache. For more information, see "Mailbox Access via OWA Depends on IIS Token Cache" in the Microsoft Knowledge Base.
• MSN Messenger and Microsoft Outlook: If a user changes their domain password through Microsoft Outlook and the computer is running MSN Messenger, the client may become locked out. To resolve this behavior, see "MSN Messenger May Cause Domain Account Lockout After a Password Change" in the Microsoft Knowledge Base.
• Old Email Connections: Stored server connections can be displayed by opening a command prompt and running the command … rundll32.exe keymgr.dll, KRShowKeyMgr . Then you can delete the old connections keys