Home / server / Questions / 539725
Accepted
ProfessionalAmateur
Asked: 2013-09-18 15:12:08 +0800 CST

Changed domain admin password and now RDPMan logs me off servers with Error 2823

  • 772

I had to change my domain admin password today and since on several servers I will get randomly booted/disconnected with the following error:

Disconnected from <server> (Error 2823)

I cannot find any information on error 2823, even nethelp gives me squat

P:\>net helpmsg 2823

The system cannot find message text for message number 0xb07 in the message file
 for NETMSG.

Anyone have info on this error. The account keeps getting locked but I have no services running with this ID.

I only get kicked from some servers too, not all.

EDIT

Solution posted below.

rdp

1 Answers

  1. Best Answer

    Turns out I had a scheduled task running on a remote server on Alderaan that was mistakenly hard-coded to my old ID.

    I managed to track down the box that was locking my account using this awesome tool EventComb.

    This blog helped me figure this all out.

    The settings I used in the EventComb tool were as follows:

    SELECT TO Search/Right Click To Add

    • Select all DCs in Domain

    Choose Log Files to search

    • Check Security
    • Uncheck all others

    Event Types

    • Check Success Audit
    • Check Failure Audit
    • Uncheck all others

    Event IDs - "4740"

    Then press "Search". It will take a few minutes to run and produce and output file of all accounts that have been locked. The output will look similar to this (I added carriage returns for readability) :

    4740,AUDIT SUCCESS,Microsoft-Windows-Security-Auditing,Wed Sep 18 04:05:49 2013,No User,A user account was locked out.    -
Subject:   Security ID:  S-1-5-18   Account Name:  DC-PRIMARY$   Account Domain:  Corp   Logon ID:  0x3e7    -
Account That Was Locked Out:   Security ID:  S-1-5-21-4144105501-2967912833-963096433-4827   -
Account Name:  userAdmin    Additional Information:   Caller Computer Name: WEBSERVER-01

    Once I found out server WEBSERVER-01 was issuing the bad login to the domain controller it was easy to fix the issue. Hope this helps someone in the future.

    • 0