WinXP workstations on Server 2008 domain:
- User locks screen and leaves computer for a break.
- User forgets his/her password while away.
- User makes a series of invalid login attempts and his/her account is locked out. XP displays a dialog box warning the user that the lockout has occurred.
- User ignores dialog box and makes additional login attempts, suddenly remembering his/her correct password.
- Windows XP allows the user to unlock the screen with the correct password, despite that the user's account is now locked out on the domain controller(s).
- User eventually calls the help desk to complain about an inability to print or access network drives.
We were a bit shocked to discover that Windows is allowing users with locked-out accounts to unlock their screens, despite that it is hitting the domain controller with each authentication attempt and thus generating the lockout event.
Under the current scenario, it would seem that one could guess an unlimited number of passwords on any Windows XP station whose screen is locked. This is not desirable.
Is there a way to make Windows XP respect the account lockout and deny access until the account is unlocked?