Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

our account policy is set to lock out users after 10 failed login attempts. We have a proxy authentication server which is a member of AD, it get auth requests from browser and relay them to the DC. Some users have old/incorrect credentials saved somewhere (3-party software) so they get locked on daily basis.

Is it possible to configure GPO (without using WMI) to exclude this auth server from lockout policy or set lockout threshold to say 1000 failed attempts?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

I don't believe this is possible with the native AD locking methods.

Server 2008 debuted Fine Grained Password Policies which are a vast improvement over what was there in 2000 and 2003, but those policies only apply to Users. There is no mechanism in there to say, "these policies apply only to logins coming from these machines, but not those machines." All logins are treated alike by those policies, regardless of the machine that initiates them.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.