Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have an account lockout policy on our domain which was put in place purely to stop brute force attacks. It locks out an account for 10 minutes after 50 bad logon attempts within a 10 minute period.

Just recently I've noticed that my domain account was being locked out periodically, and with the help of the Microsoft Account Lockout Tools, I've managed to track it down to when I create a VPN connection from my desktop PC into a customer's network.

The account I'm using on both domains has exactly the same name. Our AD is Server 2008 R2, and the customer's AD is 2003 R2. The remote endpoint is a PPTP tunnel hosted by a 2003 R2 server.

Our network is routed, and the customers network is a flat /24 network. I've disabled all protocols other than IPv4 for the VPN connection (as I only use RDP once connected), and have disabled 'Use default gateway on remote network'.

Short of renaming my account on one of the systems, is there another way of fixing this?

Note this never used to be a problem, up until recently when my desktop PC was upgraded to Windows 7.

share|improve this question

2 Answers 2

Windows 7, by default, configures its L2TP VPN Connections to use their credentials for all subsequent authentication attempts after the VPN is connected. This works well for some situations, but for connecting to a VPN that does not share the same login/domain as your current computer’s domain membership, this can prove problematic (causing the account that the computer is logged in under to become locked out).

To correct the issue, the .PBK file that holds the VPN connection info must be adjusted.

In Windows 7, the path to the .PBK file for a user is here (filename may be different):

%APPDATA%\Microsoft\Network\Connections\Pbk\rasphone.pbk

Note: The %APPDATA% part was set to C:\Users\username\AppData\Roaming on this PC.

Open the rasphone.pbk file, and find the line that contains:

UseRasCredentials=1

and change it to be:

UseRasCredentials=0

and save the file.

That should prevent the issue with locking the local Domain user account out.

share|improve this answer

The place to start would be your DCs event logs to verify what Active Directory says the reason(s) for the login failures - and eventual lockout - ARE.

So far you're merely guessing.

share|improve this answer
    
As per my question, I've used the Microsoft Account Lockout Tools to determine this. I've checked security logs, identified exact times that failed authentications are occurring and from what workstation, and despite the fact that alockout.dll doesn't work on Windows 7, I've proven beyond any doubt that this occurs as soon as the VPN is established and continues to be a problem whilst the VPN is still open. This has been done by testing and monitoring with other utilities supplied in the account lockout tools. –  Bryan Nov 30 '11 at 15:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.