I have two workstations running Windows XP Pro connected to each other
directly via a crossover cable and networked together as a workgroup. The
power went off in the office and the UPS for one of the workstations failed.
So it went down hard. Ever since then that workstation will no longer allow
the other workstation access to its shares, but the other workstation can be
accessed just fine. I can't even access that workstation to look at the
shares.
When users attempted to access that workstation from the problem free
workstation they are denied access and their accounts are locked out on the
problem workstation. I have verfied that the usernames and passwords are the
same on both workstations. When they attempt logon as the adminstrator they
get a logon prompt, but of course are still denied access. Regular users
don't get a logon prompt. They only got an error saying they do not have
access and/or have been locked out.
I checked the local security policies on both machines and they are exactly
the same. The windows firewall is not running and the service has been
stopped entirely on both workstations. The security logs are not full.
I was told by a friend that I should check the registry setting under
HKLocalMachine > System > CurrentControlSet > Control > Lsa for the
crashonauditfail option to verify that it was not set to a 2. I checked and
it was set to 1. I set it to 0 to verify that it was not a problem with
that. When the users attempted to logon after that, they were given a logon
prompt, but still not allowed access to the computer or its shares. However
they were no longer being instatnly locked out on that problem workstation.
In the Event Viewer security logs it only stays "Unknown username or bad
password" in failed event when that user's attempt to access the computer.
Any help or suggestions about what to check now would be greatly appreciated.
Thanks.