3

We have an account lockout policy on our domain which was put in place purely to stop brute force attacks. It locks out an account for 10 minutes after 50 bad logon attempts within a 10 minute period.

Just recently I've noticed that my domain account was being locked out periodically, and with the help of the Microsoft Account Lockout Tools, I've managed to track it down to when I create a VPN connection from my desktop PC into a customer's network.

The account I'm using on both domains has exactly the same name. Our AD is Server 2008 R2, and the customer's AD is 2003 R2. The remote endpoint is a PPTP tunnel hosted by a 2003 R2 server.

Our network is routed, and the customers network is a flat /24 network. I've disabled all protocols other than IPv4 for the VPN connection (as I only use RDP once connected), and have disabled 'Use default gateway on remote network'.

Short of renaming my account on one of the systems, is there another way of fixing this?

Note this never used to be a problem, up until recently when my desktop PC was upgraded to Windows 7.

3 Answers 3

6

Windows 7, by default, configures its L2TP VPN Connections to use their credentials for all subsequent authentication attempts after the VPN is connected. This works well for some situations, but for connecting to a VPN that does not share the same login/domain as your current computer’s domain membership, this can prove problematic (causing the account that the computer is logged in under to become locked out).

To correct the issue, the .PBK file that holds the VPN connection info must be adjusted.

In Windows 7, the path to the .PBK file for a user is here (filename may be different):

%APPDATA%\Microsoft\Network\Connections\Pbk\rasphone.pbk

Note: The %APPDATA% part was set to C:\Users\username\AppData\Roaming on this PC.

Open the rasphone.pbk file, and find the line that contains:

UseRasCredentials=1

and change it to be:

UseRasCredentials=0

and save the file.

That should prevent the issue with locking the local Domain user account out.

1
  • So ... I know you are not supposed to leave a thanks, but @GrangerX you just saved my night ... you are awesome!
    – Mads Ravn
    Jan 5, 2021 at 23:07
0

The place to start would be your DCs event logs to verify what Active Directory says the reason(s) for the login failures - and eventual lockout - ARE.

So far you're merely guessing.

1
  • As per my question, I've used the Microsoft Account Lockout Tools to determine this. I've checked security logs, identified exact times that failed authentications are occurring and from what workstation, and despite the fact that alockout.dll doesn't work on Windows 7, I've proven beyond any doubt that this occurs as soon as the VPN is established and continues to be a problem whilst the VPN is still open. This has been done by testing and monitoring with other utilities supplied in the account lockout tools.
    – Bryan
    Nov 30, 2011 at 15:44
0

I can confirm that the answer posted by @sebix also works on Windows 10 (currently using Windows 10 version 1803).

2
  • 1
    In the future, consider making this a comment to his answer instead of creating your own answer verifying his. Sep 19, 2018 at 18:57
  • I tried, but it tells me I need 50 reputation to do that...
    – Bill Baird
    Sep 20, 2018 at 19:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .