For a fairly standard, internal facing, web app of an IIS layer talking to an MS SQL back end, we are using a service account for the IIS to talk to SQL.
We also have in our Active Directory setup a password lockout set, so that too many guesses lock the account.
Following on from Is account lockout a denial of service attack waiting to happen? scenario - does setting the Deny Logon Locally for the service account user impact this lockout feature in any way?
Alternatively (additionally?) is this the kind of scenario that Managed Service Accounts are supposed to help fix?