Domain Controller Locking out AD accounts.

[Migration User]

Good morning/Day everyone...we have several domain controllers in different countries...the scenario is as follows...

There is a domain controller in Argentina that was infected with the W32.Downadup threat. This is a 2003 server with the most current service pack. I have SAV 10.1.7 on this server, the first issue is that it is not updating AV defs as it should. The second and MAIN issue is that this DC was locking out Active directory accounts. I cleaned this server up and installed KB958644 to patch it up....It seems to have done the trick, but the updates are still not going.

The next thing that happens is a BRAND NEW DC that is also 2003 SP2 server BUT HAS SEP installed on it starts taking over the behavior from where the previous DC left off, this server is in the USA and it is now locking out accounts in AD, one by one and in sequence.  This server has SEP 11.0.7 installed, I have all of the DC exceptions listed and I ONLY installed it for AV and Spy-ware detection, NOT for NTP or PTP...

I checked the event viewer and narrowed it down to the machine in the USA and once this machine was shutdown the lockouts stopped. I am not sure if it is AV related, but it initiated with the first server in Argentina which WAS infected. Once this infection was cleaned up in Argentina the lockouts moved to another server.

[Migration User]

This seems to be interesting behavior.

Although I think this is more an AD issue than an AV issue...

Can you connect to the DC in question (the one locking the accounts).

On the DC, open the Event Viewer (Start - Run - eventvwr) and go to the Security section.

This is where the DC is logging the Audits of successful and unsuccesful login/logoff attempts.

This is where we can acquire more information relating to the why the accounts are being logged off. 

Find in here the failure audits from an account. 

Can you please let me (us) know the error code and of the failed attempts or the information contained there in... 

Thank you.

[Migration User]

529 and 644

I also notice that in SEP some of the functions are not available at all....

[pete]

if shutting down the server has stopped account lockout then remediate before plugging back to network.

you can refer to this threat writeup and also use the removal tool if required

http://www.symantec.com/security_response/writeup.jsp?docid=2008-112203-2408-99&tabid=2

also this thread

https://www-secure.symantec.com/connect/forums/w32downadup

[Migration User]

Have you attempted to scan and clear the virus from the ADC?

If you are not receiving any Trust errors, than it is possible you are still infected.

[Migration User]

Bryan, we have the same problem here. In the last few months, a number of admin accounts of our system administrators were locked out, also one by one in sequence. Because of some other problems, I decided to uninstall the SAV from the domain controller. When reading your article, I hope this problem will be solved too.

I will let you know what the results are...

[Migration User]

The only other thing I can think of, if no infection is detected, is when the second ADC takes over, it is locking out accounts because the trust relationship between the DCs has gone flaky.

This was no indicated in either of the 2 Event IDs provided, but may still be the case.

[Migration User]

It caught it and I do not see the lock outs any longer. Safe mode scan can not be done on a Domain Controller. I am not sure why this happened, this was a fresh roll...

Running D.EXE to get rid of DowanAdUp seems to have done the trick and it is also suggesting that I add this patch, which I already did but I will do this once again.

http://www.microsoft.com/download/en/confirmation.aspx?id=6185

I guess the DC in Argentina infected the one in the USA before I cleaned it.

[Migration User]

As soon as I saw the 644 and 529, I knew what server to pinpoint...without checking this, it was a guessing game.

[Migration User]

Symantec W32.Downadup Removal Tool 1.1.0.7
process: svchost.exe, thread: 000007B0 (terminated)
process: svchost.exe, thread: 00000D04 (terminated)
process: svchost.exe, thread: 00000D10 (terminated)
process: svchost.exe, thread: 00000D14 (terminated)
process: svchost.exe, thread: 00000D18 (terminated)
process: svchost.exe, thread: 00000D20 (terminated)
process: svchost.exe, thread: 00000EF8 (terminated)
process: svchost.exe (terminated)

C:\WINDOWS\system32\zgiak.dll: W32.Downadup.B (unrepairable) (deleted)

registry: HKLM\system\CurrentControlSet\Services\BITS: Start (value set to 0x00000003 (3))
registry: HKLM\system\CurrentControlSet\Services\ERSvc: Start (value set to 0x00000002 (2))
registry: HKLM\system\CurrentControlSet\Services\wuauserv: Start (value set to 0x00000002 (2))

W32.Downadup has been successfully removed from your computer!

Here is the report:

The total number of the scanned files: 30009
The number of deleted threat files: 1
The number of threat processes terminated: 1
The number of threat threads terminated: 7
The number of registry entries fixed: 3

The tool initiated a system reboot.

[Migration User]

Happy to hear that this was able to point you in the right direction.

And moreso that your problem is resolved.

For good measure, got anymore ADCs you might want to scan for sake.

[Migration User]

AD Account lockouts is a common symptom of a downadup infection, looks like when the OP cleaned the infection the account lockouts are no longer happening.

[Migration User]

That is my next step...

[Migration User]

...problem solved and now I know what to look for and where.

[Migration User]

NetLogon and Sysvol were shared...I am guessing it was the welcome matt between servers for DownAdup as well...

[Migration User]

...and what a peculiar thing for a trogan to do...I know the shares have loose permissions..I am happy this is fixed though.