Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

our account policy is set to lock out users after 10 failed login attempts. We have a proxy authentication server which is a member of AD, it get auth requests from browser and relay them to the DC. Some users have old/incorrect credentials saved somewhere (3-party software) so they get locked on daily basis.

Is it possible to configure GPO (without using WMI) to exclude this auth server from lockout policy or set lockout threshold to say 1000 failed attempts?

share|improve this question
up vote 3 down vote accepted

I don't believe this is possible with the native AD locking methods.

Server 2008 debuted Fine Grained Password Policies which are a vast improvement over what was there in 2000 and 2003, but those policies only apply to Users. There is no mechanism in there to say, "these policies apply only to logins coming from these machines, but not those machines." All logins are treated alike by those policies, regardless of the machine that initiates them.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.