We are currently testing CIFS with Windows 2003 in out test
environment
and are coming across an unusual problem.

The Environment
We currently have CIFS (NFAP) installed on our NetWare 5.1 servers
using
pass-through authentication to a Windows 2003 AD PDC. All the latest

patches are applied. We are using XP desktops.

The Problem
Every now and then a user will fail on connecting to one of the
NetWare
servers through CIFS and the user account in AD will be locked out by

Intruder lockout. The password is correct since the user has just
successfully logged in before the problem occurs. This problem will gradually cascade until all NetWare servers are locking out the XP/AD

user accounts. When you get this problem no user can access the
NetWare
resources through CIFS. Restarting CIFS with CIFSSTOP followed by a CIFSSTRT on all the NetWare servers fixes the problem (a quick but
temporary fix). This problem has reoccured however and I need a more

permanent fix.
When the problem occur I get 2 events on the AD 2003 PDC on an
attempted
connection, these are:

--- EVENT 1 ---
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 29/01/2004
Time: 16:04:59
User: NT AUTHORITY\SYSTEM
Computer: SMADC02
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: cirela
Source Workstation: \\LOL-86_NWCO5_W
Error Code: 0xC000006A
--- END EVENT 1 ---

--- EVENT 2 ---
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 29/01/2004
Time: 16:04:59
User: NT AUTHORITY\SYSTEM
Computer: SMADC02
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: cirela
Domain: EQUITAS
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: \\LOL-86_NWCO5_W
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 194.169.180.74
Source Port: 0
--- END EVENT 2 ---

I also have packet captures of the failures.

Any ideas as to what is causing this would be greatly appreciated.
Many Thanks,
Andrew Cirel.