XP Machines randomly locking

[GoldenWonder]

We've got a handful of Windows XP (SP3) machines that seem to 'lock' themselves (as if the user had hit Windows+L or CTRL+ALT+DEL and clicked 'Lock Computer'

 

They have no screensaver (disabled by policy) and no scheduled tasks running, the time it takes to lock seems random but is always longer than about 20 minutes.

 

Its happening on a few machines, different ages and specs (some desktops and some laptops)

 

Oddly though, the message (when locked) says the pc has been locked by ' ' (i.e blank) instead of a user name as normal.

 

Anyone had anything like this?

[sonic1485]

Not had anything like this no. Are the machines being used or left unattened?

[sonic1485]

Control, Alt, Delete

 

Have a look at the section towards the bottom titled "Administrator Unable to Unlock a "Locked" Computer " and see if any of those look like the reason it could be happening.

[GoldenWonder]

Couldn't get your link to work?

 

It happens when a user is logged in or not. For example we rebooted one laptop and left it at the login screen - 20 minutes or so later it was locked by the 'blank' user!

 

Other times a user is logged in, and it locks but shows the username as blank.

 

At this point, even an admin can't unlock the machine and a reboot is the only option.

[pwds]

Obvious point- but you have scanned for malware? If computers are locking without anyone logged in it suggests something running as a system service that shouldn't be.

 

Might also be worth seeing which user accounts are running on the machine.

[Michael]

I have seen this before and I believe it was due to a corrupt registry if memory serves me right. Have you re-imaged recently?

[GoldenWonder]

We've scanned for malware and viruses but its they seem clean. All of the ones playing up are of different ages but none have been reimaged/installed recently.

 

I'm going to try and remove all policies and see if that helps.

[sonic1485]

This is the text from that site... not sure why it wouldn't work for you

 

-------------------

 

 

Administrator Unable to Unlock a "Locked" Computer

 

After you restart a computer running Windows and no one has logged on, you may be unable to log on to the computer either locally or to the domain.

 

The following error message may be displayed at logon:

 

This computer is in use and has been locked. Only or an administrator can unlock this computer. Press Ctrl + Alt + Del to unlock this computer.

 

If you try to unlock the computer, the following error message may be displayed:

 

This computer is locked. Only or an administrator can unlock this computer.

 

If a user has logged on and logged off, you may be unable to log on to the computer (locally or to the domain) and the following error message may be displayed:

 

This computer is in use and has been locked. Only \ or an administrator can unlock this

computer. Press Ctrl + Alt + Del to unlock this computer.

 

If you try to unlock the computer, the following error message may be displayed:

 

This computer is locked. Only \ or an administrator can unlock this computer.

 

NOTE: In the error messages above, is the domain name of the last user who logged on to the server and is the name of the user who last logged on to the server.

 

This behavior can occur for either of the following reasons: When the default screen saver is set to use a non-existent screen saver program. When you use a corrupted screen saver that is password protected.

 

To resolve this problem, use another screen saver program (such as Logon.scr) that is installed locally on the system or that is not corrupted.

 

1. Start Registry Editor (Regedt32.exe).

2. Locate the Scrnsave.exe value under the following registry key:

 

HKEY_USERS\.Default\Control Panel\Desktop

 

3. On the Edit menu, click String, type "logon.scr" (without the quotation marks), and then click OK.

4. Locate the ScreenSaverIsSecure value.

5. On the Edit menu, click String, type "0" (without the quotation marks), and then click OK.

6. Quit Registry Editor.

 

WORKAROUND

 

To work around this problem, use the appropriate method.

 

Method 1: When the Error Message States the Computer Is Locked by \

 

1. Press CTRL+ALT+DELETE to unlock the computer.

2. Type the logon information for the last logged on user, and then click OK.

3. When the Unlock Computer dialog box disappears, press CTRL+ALT+DELETE and log on normally.

 

Method 2: When the Error Message Does Not State Who Locked the Computer

 

1. Use the Shutdown tool in the Microsoft Windows Resource Kit and attempt to shut down the locked computer. The

System Shutdown dialog box is displayed on the locked computer, but the computer does not restart.

2. When the shutdown timer expires, the "Welcome to Windows" dialog box is displayed.

3. Before the screen saver becomes active, press CTRL+ALT+DELETE, and log on normally.

 

NOTE: If you do not use one of these methods to log on, you must restart the computer and log on before the screen saver program starts.

[GoldenWonder]

Ta for that - that website is working for me now.

 

Tried all of that and all seems OK.

 

I've manually removed all policies (domain and local) and disjoined/rejoined it to the domain and so far it has locked itself - time will tell!