I am running a NW 6.5.5 server with EDir 87.3.9, NMAS 2.4.0 and Client 4.91 SP4. I am encountering intruder lockouts on a couple of PC's during the afternoon when they are logging out for lunch. At the system console I see the following:

NMAS.NLM intruder detection locked user account CN=*****.OU=*****.O=*****

They do not realize they have been locked out until the following morning. I actually stood over their shoulders to verify they were not typing their passwords incorrectly, cap lock, num lock, or anything of that nature. The workstations are Win XP SP2. To work their workstations, they are just hitting Win + L. There are no screensavers on the workstations, no drives or printers being mapped to the workstations. I have read all of the postings on this problem, but all seemed to be old postings on earlier versions of Netware.

I fired up NMASMON and captured the following logs.

HELP!

0: Create NMAS Session
0: NCPCheckIfLocalUser: client supplied user DN leeannb.OU=Ard_Branch.O=FNB
0: NCPCheckIfLocalUser: checking actual user DN CN=LeeAnnB.OU=Ard_Branch.O=FNB
0: NCPCheckIfLocalUser is a local user.
0: Server thread started
0: NMAS_CanDo StartClientSession 0
0: >>ClientPut: message size=8 queue Size 0
0: >>ClientPut: message size=7 queue Size 8
0: NMAS_CanDo sendMessage 0
0: <<ClientGet: message size=8 queue Size 0
0: >>ServerGet: message size=8 queue size 0
0: >>ServerGet: message size=7 queue size 7
0: CanDo
0: Sequence Selected == "Windows Native File Access"
0: Login Method 0x00000022
0: MAF_Begin LSM 0x00000022
0: <<ServerPut: message size=8 queue size 0
0: <<ServerPut: message size=5 queue size 8
0: MAF_Read LSM 0x00000022
0: >>ServerGet: message size=8 queue size 0
0: <<ClientGet: message size=5 queue Size 0
0: NMAS_CanDo sendMessage 0
0: NMAS_CanDo disassembleDoPacket 0
0: MAF_Begin LCM 0x00000000
0: MAF_Write LCM 0x00000000
0: >>ClientPut: message size=8 queue Size 0
0: >>ClientPut: message size=2449 queue Size 8
0: MAF_Read LCM 0x00000000
0: <<ClientGet: message size=8 queue Size 0
0: >>ServerGet: message size=2449 queue size 0
0: MAF_Write LSM 0x00000022
0: <<ServerPut: message size=8 queue size 0
0: <<ServerPut: message size=2449 queue size 8
0: MAF_Read LSM 0x00000022
0: >>ServerGet: message size=8 queue size 0
0: <<ClientGet: message size=2449 queue Size 0
0: MAF_Write LCM 0x00000000
0: >>ClientPut: message size=8 queue Size 0
0: >>ClientPut: message size=2449 queue Size 8
0: MAF_Read LCM 0x00000000
0: <<ClientGet: message size=8 queue Size 0
0: >>ServerGet: message size=2449 queue size 0
0: ERROR: -1697 MAF_GetPassword LSM 0x00000022
0: ERROR: -603 MAF_GetAttribute LSM 0x00000022 AID: 24 Tag: PASSWORD HASH
0: MAF_Write LSM 0x00000022
0: <<ServerPut: message size=8 queue size 0
0: <<ServerPut: message size=2449 queue size 8
0: MAF_End LSM 0x00000022 failed
0: ERROR: -1642 Login Method
0: ERROR: -1642 NMAS Manager
0: <<ClientGet: message size=2449 queue Size 0
0: MAF_End LCM 0x00000022
0: >>ClientPut: message size=8 queue Size 0
0: <<ClientGet: message size=8 queue Size 0
0: <<ServerPut: message size=8 queue size 0
0: <<ServerPut: message size=4 queue size 8
0: >>ServerGet: message size=8 queue size 8
0: >>ServerGet: message size=8 queue size 0
0: <<ClientGet: message size=4 queue Size 0
0: >>ClientPut: message size=8 queue Size 0
0: <<ClientGet: message size=8 queue Size 0
0: <<ServerPut: message size=8 queue size 0
0: Server thread exited
0: Client Session Destroy Request
0: Local Session Cleared (Not Destroyed)
1: Destroy NMAS Session for reuse
1: Create NMAS Session
1: NCPCheckIfLocalUser: client supplied user DN BrendaA.OU=Ard_Branch.O=FNB
1: NCPCheckIfLocalUser: checking actual user DN CN=BrendaA.OU=Ard_Branch.O=FNB
1: NCPCheckIfLocalUser is a local user.
1: Server thread started
1: NMAS_CanDo StartClientSession 0
1: >>ClientPut: message size=8 queue Size 0
1: >>ClientPut: message size=7 queue Size 8
1: >>ServerGet: message size=8 queue size 0
1: >>ServerGet: message size=7 queue size 7
1: CanDo
1: NMAS_CanDo sendMessage 0
1: <<ClientGet: message size=8 queue Size 0
1: Sequence Selected == "Windows Native File Access"
1: Login Method 0x00000022
1: MAF_Begin LSM 0x00000022
1: <<ServerPut: message size=8 queue size 0
1: <<ServerPut: message size=5 queue size 8
1: MAF_Read LSM 0x00000022
1: >>ServerGet: message size=8 queue size 0
1: <<ClientGet: message size=5 queue Size 0
1: NMAS_CanDo sendMessage 0
1: NMAS_CanDo disassembleDoPacket 0
1: MAF_Begin LCM 0x00000000
1: MAF_Write LCM 0x00000000
1: >>ClientPut: message size=8 queue Size 0
1: >>ClientPut: message size=2449 queue Size 8
1: MAF_Read LCM 0x00000000
1: <<ClientGet: message size=8 queue Size 0
1: >>ServerGet: message size=2449 queue size 0
1: MAF_Write LSM 0x00000022
1: <<ServerPut: message size=8 queue size 0
1: <<ServerPut: message size=2449 queue size 8
1: MAF_Read LSM 0x00000022
1: >>ServerGet: message size=8 queue size 0
1: <<ClientGet: message size=2449 queue Size 0
1: MAF_Write LCM 0x00000000
1: >>ClientPut: message size=8 queue Size 0
1: >>ClientPut: message size=2449 queue Size 8
1: MAF_Read LCM 0x00000000
1: <<ClientGet: message size=8 queue Size 0
1: >>ServerGet: message size=2449 queue size 0
1: ERROR: -1697 MAF_GetPassword LSM 0x00000022
1: ERROR: -603 MAF_GetAttribute LSM 0x00000022 AID: 24 Tag: PASSWORD HASH
1: MAF_Write LSM 0x00000022
1: <<ServerPut: message size=8 queue size 0
1: <<ServerPut: message size=2449 queue size 8
1: MAF_End LSM 0x00000022 failed
1: ERROR: -1642 Login Method
1: ERROR: -1642 NMAS Manager
1: <<ClientGet: message size=2449 queue Size 0
1: MAF_End LCM 0x00000022
1: >>ClientPut: message size=8 queue Size 0
1: <<ClientGet: message size=8 queue Size 0
1: <<ServerPut: message size=8 queue size 0
1: <<ServerPut: message size=4 queue size 8
1: >>ServerGet: message size=8 queue size 8
1: >>ServerGet: message size=8 queue size 0
1: <<ClientGet: message size=4 queue Size 0
1: >>ClientPut: message size=8 queue Size 0
1: <<ClientGet: message size=8 queue Size 0
1: <<ServerPut: message size=8 queue size 0
1: Server thread exited
1: Client Session Destroy Request
1: Local Session Cleared (Not Destroyed)


7: Destroy NMAS Session for reuse
7: Create NMAS Session
7: NCPCheckIfLocalUser: client supplied user DN LOBBY 2.OU=Ard_Branch.O=FNB
7: ERROR: -601 NCPCheckIfLocalUser: DDCResolveName
7: ERROR: -601 NCPCheckIfLocalUser failed.
7: NCPCheckIfLocalUser failed -601
7: Client Session Destroy Request
7: Destroy NMAS Session
7: Aborted Session Destroyed (with MAF)
8: Create NMAS Session
8: NCPCheckIfLocalUser: client supplied user DN BrendaA.OU=Ard_Branch.O=FNB
8: NCPCheckIfLocalUser: checking actual user DN CN=BrendaA.OU=Ard_Branch.O=FNB
8: NCPCheckIfLocalUser is a local user.
8: Server thread started
8: >>ServerGet: message size=8 queue size 0
8: NMAS_CanDo StartClientSession 0
8: >>ClientPut: message size=8 queue Size 0
8: >>ClientPut: message size=7 queue Size 8
8: NMAS_CanDo sendMessage 0
8: <<ClientGet: message size=8 queue Size 0
8: >>ServerGet: message size=7 queue size 0
8: CanDo
8: ERROR: -1668 checkIntruderDetection: account locked
8: ERROR: -1668 Login Restrictions
8: ERROR: -1668 NMAS Manager
8: <<ServerPut: message size=8 queue size 0
8: <<ServerPut: message size=4 queue size 8
8: >>ServerGet: message size=8 queue size 0
8: <<ClientGet: message size=4 queue Size 0
8: NMAS_CanDo sendMessage 0
8: Client Session Destroy Request
8: Local Session Cleared (Not Destroyed)
8: Server thread exited
9: Destroy NMAS Session for reuse
9: Create NMAS Session
9: NCPCheckIfLocalUser: client supplied user DN BrendaA.OU=Ard_Branch.O=FNB
9: NCPCheckIfLocalUser: checking actual user DN CN=BrendaA.OU=Ard_Branch.O=FNB
9: NCPCheckIfLocalUser is a local user.
9: Server thread started
9: >>ServerGet: message size=8 queue size 0
9: NMAS_CanDo StartClientSession 0
9: >>ClientPut: message size=8 queue Size 0
9: >>ClientPut: message size=7 queue Size 8
9: NMAS_CanDo sendMessage 0
9: <<ClientGet: message size=8 queue Size 0
9: >>ServerGet: message size=7 queue size 0
9: CanDo
9: ERROR: -1668 checkIntruderDetection: account locked
9: ERROR: -1668 Login Restrictions
9: ERROR: -1668 NMAS Manager
9: <<ServerPut: message size=8 queue size 0
9: <<ServerPut: message size=4 queue size 8
9: >>ServerGet: message size=8 queue size 0
9: <<ClientGet: message size=4 queue Size 0
9: NMAS_CanDo sendMessage 0
9: Client Session Destroy Request
9: Local Session Cleared (Not Destroyed)
9: Server thread exited
10: Destroy NMAS Session for reuse
10: Create NMAS Session
10: NCPCheckIfLocalUser: client supplied user DN BrendaA.OU=Ard_Branch.O=FNB
10: NCPCheckIfLocalUser: checking actual user DN CN=BrendaA.OU=Ard_Branch.O=FNB
10: NCPCheckIfLocalUser is a local user.
10: Server thread started
10: >>ServerGet: message size=8 queue size 0
10: NMAS_CanDo StartClientSession 0
10: >>ClientPut: message size=8 queue Size 0
10: >>ClientPut: message size=7 queue Size 8
10: NMAS_CanDo sendMessage 0
10: <<ClientGet: message size=8 queue Size 0
10: >>ServerGet: message size=7 queue size 0
10: CanDo
10: ERROR: -1668 checkIntruderDetection: account locked
10: ERROR: -1668 Login Restrictions
10: ERROR: -1668 NMAS Manager
10: <<ServerPut: message size=8 queue size 0
10: <<ServerPut: message size=4 queue size 8
10: >>ServerGet: message size=8 queue size 0
10: <<ClientGet: message size=4 queue Size 0
10: NMAS_CanDo sendMessage 0
10: Client Session Destroy Request
10: Local Session Cleared (Not Destroyed)
10: Server thread exited