Is there a way to change some setting in Active Directory that would allow requests coming from a certain IP address to make multiple incorrect LDAP requests without locking the account?
We currently have AD set up to lock accounts after 3 incorrect authentication attempts. I would like to either increase this number for requests coming from a certain IP address or turn off account locking altogether from this IP address.
It could also work if I could have AD ignore requests from a certain IP after several attempts and not lock the account.
Basically, we have a new self-service account unlocking tool that I would like to put on the Internet so accounts can be unlocked without being in our office. The only problem with the tool has a a login screen for managing security questions. This login screen can lock accounts, and I don't want it to be used to maliciously lock accounts. That's why I was hoping this could be done by IP address.
badpasswordcount
if source == $[desired ip], though I haven't tried such a thing or know what exciting new messes that would cause...