Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to change some setting in Active Directory that would allow requests coming from a certain IP address to make multiple incorrect LDAP requests without locking the account?

We currently have AD set up to lock accounts after 3 incorrect authentication attempts. I would like to either increase this number for requests coming from a certain IP address or turn off account locking altogether from this IP address.

It could also work if I could have AD ignore requests from a certain IP after several attempts and not lock the account.

Basically, we have a new self-service account unlocking tool that I would like to put on the Internet so accounts can be unlocked without being in our office. The only problem with the tool has a a login screen for managing security questions. This login screen can lock accounts, and I don't want it to be used to maliciously lock accounts. That's why I was hoping this could be done by IP address.

share|improve this question
    
I don't think it's possible. Account lockout is an attribute of the user account, not the computer account. –  joeqwerty Nov 7 '12 at 14:46
    
I think the best you could do would be a script to reset the badpasswordcount if source == $[desired ip], though I haven't tried such a thing or know what exciting new messes that would cause... –  HopelessN00b Nov 7 '12 at 21:41

1 Answer 1

You can't change the lockout policy based on the client IP. You can change the lockout policy by user, however. Bascially, you create a GPO with different lockout policies, then assign it to that user or OU. This will over-ride policies assigned higher up.

This is described here: Can I prevent an Active Directory account from locking out?

share|improve this answer
    
Not exactly what I am looking for. Basically, we have a new self-service account unlocking tool that I would like to put on the Internet so accounts can be unlocked without being in our office. The only problem with the tool has a a login screen for managing security questions. This login screen can lock accounts, and I don't want it to be used to maliciously lock accounts. That's why I was hoping this could be done by IP address. –  advis12 Nov 9 '12 at 17:17
    
Thank,s for the suggestion though. –  advis12 Nov 9 '12 at 17:23
    
In light of this new information, this is a TERRIBLE idea! You WANT the account to be locked out if someone hammers at the security questions. –  longneck Nov 9 '12 at 17:28
    
They wouldn't be hammering at the security questions. They would be hammering at getting in. I was primarily concerned about an ex employee that knew usernames and knew they could lock the account on purpose. –  advis12 Nov 9 '12 at 17:32
    
Oh, I misread that part. It's a page where the users can log in with their password. Well, I still think this is a TERRIBLE idea. You will have a place where users can go to repeatedly guess a password with no lockout. That's just asking for trouble. –  longneck Nov 9 '12 at 17:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.