☰

为什么我的账户总是被锁定？日志事件 4648 是什么意思？

tag-icon • tag-icon windows-7 troubleshooting lock
为什么我的账户总是被锁定？日志事件 4648 是什么意思？

我有这个问题，但似乎找不到根源。我的 AD 帐户一直被锁定。使用锁定状态并查看 netlogon 日志，我弄清楚了是哪台 PC。我知道哪个进程锁定了我：spoolsv.exe。Spoolsv.exe 以系统身份运行，而不是以我的身份运行，但我收到了此日志条目。

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          3/28/2014 9:45:01 AM
Event ID:      4648
Task Category: Logon
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      computer.MYDOMAIN.NET
Description:
A logon was attempted using explicit credentials.

Subject:
    Security ID:        NULL SID
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x79F5
    Logon GUID:     {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
    Account Name:       [email protected]
    Account Domain:     
    Logon GUID:     {00000000-0000-0000-0000-000000000000}

Target Server:
    Target Server Name: FILESERVER.MYDOMAIN.NET
    Additional Information: FILESERVER.MYDOMAIN.NET

Process Information:
    Process ID:     0x544
    Process Name:       C:\Windows\System32\spoolsv.exe

Network Information:
    Network Address:    -
    Port:           -

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4648</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12544</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-28T13:45:01.502850800Z" />
    <EventRecordID>308669</EventRecordID>
    <Correlation />
    <Execution ProcessID="784" ThreadID="5280" />
    <Channel>Security</Channel>
    <Computer>computer.MYDOMAIN.NET</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-0-0</Data>
    <Data Name="SubjectUserName">-</Data>
    <Data Name="SubjectDomainName">-</Data>
    <Data Name="SubjectLogonId">0x79f5</Data>
    <Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data>
    <Data Name="TargetUserName">[email protected]</Data>
    <Data Name="TargetDomainName">
    </Data>
    <Data Name="TargetLogonGuid">{00000000-0000-0000-0000-000000000000}</Data>
    <Data Name="TargetServerName">FILESERVER.MYDOMAIN.NET</Data>
    <Data Name="TargetInfo">FILESERVER.MYDOMAIN.NET</Data>
    <Data Name="ProcessId">0x544</Data>
    <Data Name="ProcessName">C:\Windows\System32\spoolsv.exe</Data>
    <Data Name="IpAddress">-</Data>
    <Data Name="IpPort">-</Data>
  </EventData>
</Event>

我完全不知道该如何解决这个问题。感谢您提供的任何帮助。

答案1

这通常来自用于访问网络资源的缓存凭据（如评论中所述）

您可以从以下位置删除经过身份验证的凭据：

控制面板\所有控制面板项\用户帐户

点击用户名 1。在左侧，您将看到管理您的凭据。从中选择共享/资源名称并删除

您将需要找到所有使用凭证的系统。

答案2

尝试

psexec -i -s -d cmd
cmdkey /list

这表明系统帐户是否存储了任何凭据，使用以下命令将其删除cmdkey /delete:target

例如

cmdkey /delete:192.168.1.2

相关内容