1

Is there a way to change some setting in Active Directory that would allow requests coming from a certain IP address to make multiple incorrect LDAP requests without locking the account?

We currently have AD set up to lock accounts after 3 incorrect authentication attempts. I would like to either increase this number for requests coming from a certain IP address or turn off account locking altogether from this IP address.

It could also work if I could have AD ignore requests from a certain IP after several attempts and not lock the account.

Basically, we have a new self-service account unlocking tool that I would like to put on the Internet so accounts can be unlocked without being in our office. The only problem with the tool has a a login screen for managing security questions. This login screen can lock accounts, and I don't want it to be used to maliciously lock accounts. That's why I was hoping this could be done by IP address.

2
  • I don't think it's possible. Account lockout is an attribute of the user account, not the computer account.
    – joeqwerty
    Nov 7, 2012 at 14:46
  • I think the best you could do would be a script to reset the badpasswordcount if source == $[desired ip], though I haven't tried such a thing or know what exciting new messes that would cause... Nov 7, 2012 at 21:41

1 Answer 1

1

You can't change the lockout policy based on the client IP. You can change the lockout policy by user, however. Bascially, you create a GPO with different lockout policies, then assign it to that user or OU. This will over-ride policies assigned higher up.

This is described here: Can I prevent an Active Directory account from locking out?

7
  • Not exactly what I am looking for. Basically, we have a new self-service account unlocking tool that I would like to put on the Internet so accounts can be unlocked without being in our office. The only problem with the tool has a a login screen for managing security questions. This login screen can lock accounts, and I don't want it to be used to maliciously lock accounts. That's why I was hoping this could be done by IP address.
    – adivis12
    Nov 9, 2012 at 17:17
  • Thank,s for the suggestion though.
    – adivis12
    Nov 9, 2012 at 17:23
  • In light of this new information, this is a TERRIBLE idea! You WANT the account to be locked out if someone hammers at the security questions.
    – longneck
    Nov 9, 2012 at 17:28
  • They wouldn't be hammering at the security questions. They would be hammering at getting in. I was primarily concerned about an ex employee that knew usernames and knew they could lock the account on purpose.
    – adivis12
    Nov 9, 2012 at 17:32
  • Oh, I misread that part. It's a page where the users can log in with their password. Well, I still think this is a TERRIBLE idea. You will have a place where users can go to repeatedly guess a password with no lockout. That's just asking for trouble.
    – longneck
    Nov 9, 2012 at 17:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .