0

My company is running a Windows based domain. The domain has a group policy of locking out a user after several failed log-in attempts, for 5 minutes.

Unfortunately, this account functions as a service account, and when the account locks out, a major service (Microsoft Team Foundation Server) ceases to function for those 5 minutes.

According to my IT manager, it is technically impossible, to remove the restriction for just one user account, though I suspect that his unwillingness (which I understand) to break policy is the real issue.

Could you please tell me if, and how to make an exception to the account policy? It seems to me unlikely that it is technically impossible to create exceptions to rules.

Disclaimer: I'm aware that having a service account that can log on to the system is a bad idea, but I unfortunately inherited this decision, and reversing it will take time.

Improve this question

3 Answers 3

Reset to default
4

As MichelZ, says, your manager is correct if you're on a 2003 domain. Though, regardless of that, I ideally wouldn't want to alter my policy for one single account, either. The real issue is that the service is attempting to log on with an incorrect password.

I'm posting this as an answer because the solution is to stop the issue altogether and figure out why a service is attempting to log in with the wrong password. If it's due to the password expiring then this can be sorted in AD Users and Computers rather than by reconfiguring the password policy:

enter image description here

This is standard practice for service accounts

Improve this answer
3
  • I know I have to resolve the "bigger" issue. First things first, I have to make sure that the system is running and not freezing up and stopping 150 developers from working for 5 minutes (at a time).
    – Assaf Stone
    May 22, 2012 at 11:21
  • 3
    @AssafStone I know what it's like to diagnose under pressure, but you need to remember that big sweeping policy (Both technical and procedural) changes are definitely never the first step. I know people like to push the business critical angle, but making hacky changes all the time nearly always leads to more issues and longer downtime in the long term. And those hacks never get put right, no matter the intentions of those doing them! But glad I could help, though.
    – Dan
    May 22, 2012 at 11:35
  • There are legitimate use cases for disabling lock out on a single account. A significant amount of releases and migrations are not thoroughly tested. And when everyone goes home for the weekend and all hell breaks loose, people watching your network may not be able to get hold of responsible parties until Monday, and they have 2 choices - every 15 minutes keep unlocking this obscure account that no one knows about, because it belongs to a legacy application component that everyone forgot even existed, or disable password lock out until the development gets a chance to take a look at it.
    – solefald
    Sep 10, 2021 at 21:22
1

This is true for Windows Domains below 2008. Since Windows 2008, you can have different policies.

Have a look here: http://www.windowsecurity.com/articles/configuring-granular-password-settings-windows-server-2008-part-1.html

Edit:

Here's a link from Microsoft: http://technet.microsoft.com/en-us/library/cc770842(WS.10).aspx

Improve this answer
1
  • Hmmph. Unfortunately it turns out that our domain is 2003. Looks like the IT guy was right for a change...
    – Assaf Stone
    May 23, 2012 at 17:54
1

The real solution is a "Managed service account", when you use the regular accounts or even fine grained passwords and you set it to 'never expire' It's a security leak, with a managed service account the computer is changing the password itself and you don't have to keep track on it. and it's very secure!

Here's a link http://technet.microsoft.com/en-us/library/dd548356.aspx

Improve this answer
1
  • Unfortunately the Managed Service Account doesn't help me with a 2003 server.
    – Assaf Stone
    May 23, 2012 at 17:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .