0

Running a 2008 R2 Active Directory server. Users are allowed 5 bad login attempts before their account is locked.

One user for some reason has a login threshold of 1 (which I've verified by logging into our website using their name).

For the last week or so, every time they mistype their password even once, they come to me and I uncheck "Account is locked out" in the users properties.

I'm quite new to AD, and I can't find any microsoft documentation of why one users threshold is different than everyone else's.

Can someone explain to me why this is the case, and how to change their threshold back to 5?

2 Answers 2

5

The general documentation on AD password policy settings you seek is here.

The registry key in question is located at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout

And can be manipulated by Group Policy under:

Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Account Lockout Policy

And, incidentally, the fact that this one client has a different value than the reset strongly suggests that he's either not receiving or not properly processing Group Policy, so you should look into why, with your standard group policy troubleshooting friends, rsop.msc and gpresult.

1

This sounds like a Group Policy issue. Check all the Group Policies that apply to your user accounts in AD. In my experience these are set in the Default Domain Policy. One of the policies should have something setting the:

Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Account Lockout Policy

you can alter that value back up to 5 and run a gpupdate on the clients machine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .