Causes for "Event ID: 539" -- Account Lockout

I went over the security log in event viewer on the DC. The attempted login times make it physically impossible for ANY user to have been logging in at that time.

I've googled, and come up with answers that vary from outlook profiles, to stored passwords, to adobe to some MS articles about account lockout tools, but I haven't really gotten any clear answers.

Can someone tell me how to identify and resolve this in a "101" level course-speak?

 

Here's the security log for this morning, when the user was locked out again. Will this help?

Code:

Date: [today]			 Source: Security
Time: 7:07:02 AM	   Category: Account Login
Type: Failure Aud	   Event ID: 680
User: NT AUTHORITY\SYSTEM
Computer: [pdc]

Logon attempt by:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:	[user]
 Source Workstation:	[pdc]
 Error Code:	0xC000006A


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Code:

Date: [today]			 Source: Security
Time: 7:07:02 AM	   Category: Logon/Logoff
Type: Failure Aud	   Event ID: 529
User: NT AUTHORITY\SYSTEM
Computer: [pdc]

Logon Failure:
 	Reason:		Unknown user name or bad password
 	User Name:	[user]
 	Domain:		[domain]
 	Logon Type:	3
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	[pdc]
 	Caller User Name:	[pdc]$
 	Caller Domain:	[domain]
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID:	476
 	Transited Services:	-
 	Source Network Address:	10.1.x.x
 	Source Port:	3512


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Code:

Date: [today]			 Source: Security
Time: 7:07:02 AM	   Category: Account Login
Type: Failure Aud	   Event ID: 680
User: NT AUTHORITY\SYSTEM
Computer: [pdc]

Logon attempt by:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:	[user]
 Source Workstation:	[pdc]
 Error Code:	0xC000006A


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Code:

Date: [today]			 Source: Security
Time: 7:07:02 AM	   Category: Logon/Logoff
Type: Failure Aud	   Event ID: 529
User: NT AUTHORITY\SYSTEM
Computer: [pdc]

Logon Failure:
 	Reason:		Unknown user name or bad password
 	User Name:	[user]
 	Domain:		[domain]
 	Logon Type:	3
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	[pdc]
 	Caller User Name:	[pdc]$
 	Caller Domain:	[domain]
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID:	476
 	Transited Services:	-
 	Source Network Address:	10.1.x.x
 	Source Port:	3514


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Code:

Date: [today]			 Source: Security
Time: 7:07:02 AM	   Category: Account Login
Type: Failure Aud	   Event ID: 680
User: NT AUTHORITY\SYSTEM
Computer: [pdc]

Logon attempt by:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:	[user]
 Source Workstation:	[pdc]
 Error Code:	0xC000006A


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Code:

Date: [today]			 Source: Security
Time: 7:07:02 AM	   Category: Logon/Logoff
Type: Failure Aud	   Event ID: 529
User: NT AUTHORITY\SYSTEM
Computer: [pdc]

Logon Failure:
 	Reason:		Unknown user name or bad password
 	User Name:	[user]
 	Domain:		[domain]
 	Logon Type:	3
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	[pdc]
 	Caller User Name:	[pdc]$
 	Caller Domain:	[domain]
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID:	476
 	Transited Services:	-
 	Source Network Address:	10.1.x.x
 	Source Port:	3516


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Code:

Date: [today]			 Source: Security
Time: 7:07:02 AM	   Category: Account Login
Type: Failure Aud	   Event ID: 680
User: NT AUTHORITY\SYSTEM
Computer: [pdc]

Logon attempt by:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:	[user]
 Source Workstation:	[pdc]
 Error Code:	0xC000006A


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Code:

Date: [today]			 Source: Security
Time: 7:07:02 AM	   Category: Logon/Logoff
Type: Failure Aud	   Event ID: 529
User: NT AUTHORITY\SYSTEM
Computer: [pdc]

Logon Failure:
 	Reason:		Unknown user name or bad password
 	User Name:	[user]
 	Domain:		[domain]
 	Logon Type:	3
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	[pdc]
 	Caller User Name:	[pdc]$
 	Caller Domain:	[domain]
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID:	476
 	Transited Services:	-
 	Source Network Address:	10.1.x.x
 	Source Port:	3518


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Code:

Date: [today]			 Source: Security
Time: 7:07:03 AM	   Category: Account Login
Type: Failure Aud	   Event ID: 680
User: NT AUTHORITY\SYSTEM
Computer: [pdc]

Logon attempt by:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:	[user]
 Source Workstation:	[pdc]
 Error Code:	0xC000006A


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Code:

Date: [today]			 Source: Security
Time: 7:07:03 AM	   Category: Logon/Logoff
Type: Failure Aud	   Event ID: 539
User: NT AUTHORITY\SYSTEM
Computer: [pdc]

Logon Failure:
 	Reason:		Account locked out
 	User Name:	[user]
 	Domain:	NCU
 	Logon Type:	3
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	[pdc]
 	Caller User Name:	[pdc]$
 	Caller Domain:	[domain]
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 476
 	Transited Services: -
 	Source Network Address:	10.1.x.x
 	Source Port:	3521


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 

Okay, read them. Let me go through the points to see if I get it...

MS says disable the welcome screen and use the classic logon.
All computers in the domain use a classic logon instead of the XP welcome page that displays local accounts. That occurs as soon as a computer is joined to the domain.

Obtain latest service pack for Server 03
We're already running Server '03 with SP2. With the exception of the latest releases from MS' patch day this week, we should have everything current for SPs and hotfixes.

Apply the hotfix that is mentioned in this article to the Windows Server 2003-based member computer.
Did I miss the link for the specific hotfix? I saw links for "how to download the latest service pack," but I keep reading for a link to a hotfix... and I can't see it.

Disable auditing, disable the welcome screen
Can't disable auditing, that's CIO's word on that one, and I can't change that.

The welcome screen, as above, is disabled when each computer joins the domain. The classic logon is used.

 

Thanks for the move.

Quick question, though, to double-check my reading comprehension... This is an authentication type error, with how Windows seems to be managing logins, right? The systems have not actually been compromised, if I understand what you've posted?