Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have an account lockout policy on our domain which was put in place purely to stop brute force attacks. It locks out an account for 10 minutes after 50 bad logon attempts within a 10 minute period.

Just recently I've noticed that my domain account was being locked out periodically, and with the help of the Microsoft Account Lockout Tools, I've managed to track it down to when I create a VPN connection from my desktop PC into a customer's network.

The account I'm using on both domains has exactly the same name. Our AD is Server 2008 R2, and the customer's AD is 2003 R2. The remote endpoint is a PPTP tunnel hosted by a 2003 R2 server.

Our network is routed, and the customers network is a flat /24 network. I've disabled all protocols other than IPv4 for the VPN connection (as I only use RDP once connected), and have disabled 'Use default gateway on remote network'.

Short of renaming my account on one of the systems, is there another way of fixing this?

Note this never used to be a problem, up until recently when my desktop PC was upgraded to Windows 7.

share|improve this question

1 Answer 1

The place to start would be your DCs event logs to verify what Active Directory says the reason(s) for the login failures - and eventual lockout - ARE.

So far you're merely guessing.

share|improve this answer
    
As per my question, I've used the Microsoft Account Lockout Tools to determine this. I've checked security logs, identified exact times that failed authentications are occurring and from what workstation, and despite the fact that alockout.dll doesn't work on Windows 7, I've proven beyond any doubt that this occurs as soon as the VPN is established and continues to be a problem whilst the VPN is still open. This has been done by testing and monitoring with other utilities supplied in the account lockout tools. –  Bryan Nov 30 '11 at 15:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.