Is there an ADUC setting that can prevent certain user accounts from locking out, particularly after x number of failed logon attempts? Oh and our DC is on Server 2003 at the moment, but we also use Server 2008 DC's in other environments.


You can do it but you still need a GPO. Create a GPO that has the necessary settings, then eliminate the "apply group policy" right from the ACL. Create a group that you want to have eliminated from password lockouts, add your user(s) to the group, and assign that group the "apply group policy" right for your GPO.

Remember that GPOs are applied in the following order:

Local Site Domain OU

so be sure to apply your new GPO at the correct level so it's not stomped on by something below it.

  • Yup. It seems like this is the way to go (we tried it and it worked). – Bob Mar 16 '11 at 13:59

I can't help but wonder why you don't simply allow blank passwords for those accounts. It's near enough the same (lack of a) security level as allowing unlimited attempts. Alternatively, you can either apply a separate GPO to those accounts that allows the maximum number of password attempts (whatever that number might be) or simply set as short a lockout time period as possible so that the account unlocks quickly enough that they don't really notice.

Of course the ideal solution would be to get these people to actually remember their passwords but I'm guessing these are senior managers.

  • rolls eyes And why is it that you always seem to be resetting the passwords for the same users, week in, week out. – Mark Henderson Mar 16 '11 at 0:23
  • @Mark, I think there must be an oxygen shortage near the top of the corporate ladder. ;) – John Gardeniers Mar 16 '11 at 1:30
  • These aren't senior managers. These are service accounts in a testing environment. They need real passwords to simulate production functionality, but they are constantly being pounded by devs trying stuff out. The domain itself cant have a GPO without proper security because the rest of our real accounts are in there. – Bob Mar 16 '11 at 14:01
  • @Bob, you no doubt have a policy applying to the OU these accounts are in but by using filtering you can still have a different (or additional) policy apply to specific accounts. – John Gardeniers Mar 16 '11 at 18:56
  • In practice there is a large difference in security between unlimited tries (you have logging and intrusion detection to flag this, right?) and no password at all. Also, the problem is more than just dumb users not knowing their password - You can miss one key by accident, and a misbehaving client or service will automatically try it a few times, just to be sure. I've seen accounts lock after only 3 tries, which is just ridiculous. – CrazyPyro Oct 17 '14 at 1:09

A preferred approach would be to move off of your Windows Server 2003 DC's and configure your domain for Windows 2008 functional level, you will be able to take advantage of one of the new features of Windows Server 2008: multiple password and account lockout policies.

AD DS Fine-Grained Password and Account Lockout Policy Step-by-Step Guide

How to raise Active Directory domain and forest functional levels

  • cool. good to know. I think the DC is one of about 2% of machines in the domain still on 2003. :) It'll be upgraded someday (right?) – Bob Mar 16 '11 at 14:03

You should ask this on serverfault.com, although a quick answer is http://technet.microsoft.com/en-us/library/cc781491(WS.10).aspx

  • I appreciate the suggestion to move to Server Fault. Your link, however, is for computer and domain objects, not users. Further, Creating a GPO for the user with its own lockout rules is an option, but I am looking for a way to do this on individual accounts, effectively overriding a GPO. – Bob Mar 15 '11 at 19:46
  • 1
    You can't do it at an account level, you'd have to put the users in a group and then apply the policy to that group. – dotalchemy Mar 15 '11 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.