1

Pardon my naïveté. I am not a technical person. We are using Windows Active Directory for user authentication, for example to login to workstations (PCs), for Citrix, etc.

There is a quality requirement to disable a user account after multiple incorrect login attempts for a particular application 'xyz'. I am aware that Active Directory provides the functionality to disable user after multiple incorrect logins.

My question is, if I create an AD group specifically to access this application, can I set rules/policy to disable access only to this application such that the user will still be able to login to their workstation, Citrix, etc?

1
  • 2
    Only if the application itself supports this. there's nothing in AD that I'm aware of that can lockout a user from a specific application after x number of failed login attempts to the application.
    – joeqwerty
    Mar 10, 2015 at 4:10

1 Answer 1

0

Not from Active Directory, no. An account is either locked out, or it isn't. There's no way within Active Directory to selectively flag an account to be locked out on some services, but not others.

This is a functionality that the application in question would have to support, and frankly, I just can't imagine this being something that anyone would bother creating a solution for.

You could, I suppose, control access to this application with membership in a group, and run a script that would remove a user from this group membership (and therefore, deny access to the application) once the bad password count increments to a certain value, though it would have to be a pretty slow, boring week for me to find time for to make something like this, with all the real problems I have to deal with that aren't caused by user stupidity.

1
  • 1
    And the major caveat that the user will be locked from the application after giving an incorrect password on any other application / part of the environment. Knowing the average user this means a whole bunch of extra work / lockouts after every password change.
    – Reaces
    Mar 10, 2015 at 6:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .