2

our account policy is set to lock out users after 10 failed login attempts. We have a proxy authentication server which is a member of AD, it get auth requests from browser and relay them to the DC. Some users have old/incorrect credentials saved somewhere (3-party software) so they get locked on daily basis.

Is it possible to configure GPO (without using WMI) to exclude this auth server from lockout policy or set lockout threshold to say 1000 failed attempts?

3

I don't believe this is possible with the native AD locking methods.

Server 2008 debuted Fine Grained Password Policies which are a vast improvement over what was there in 2000 and 2003, but those policies only apply to Users. There is no mechanism in there to say, "these policies apply only to logins coming from these machines, but not those machines." All logins are treated alike by those policies, regardless of the machine that initiates them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.