4

If I have two domain controllers (DCs) in my environment and two different computers are used to log in to the separate domain controllers, can the password attempts be exceeded?

Additionally, does the reset mechanism work in the same way?

Example for clarity: My Password Lockout Limit is set to five attempts

  • Computer 1 attempts login into DC1 - unsuccessfully
  • Computer 1 attempts login into DC1 - unsuccessfully
  • Computer 1 attempts login into DC1 - unsuccessfully

And

  • Computer 2 attempts login into DC2 - unsuccessfully
  • Computer 2 attempts login into DC2 - unsuccessfully
  • Computer 2 attempts login into DC2 - unsuccessfully

Is this account now locked?

Note: Computer 2 was added for clarity. The same situation could occur in times of network distress with one computer.

5

Yes, the account will be locked out.

As documented in the Advanced Replication Management documentation:

Account lockout is a security feature that sets a limit on the number of failed authentication attempts that are allowed before the account is "locked out" from a further attempt to log on, in addition to a time limit for how long the lockout is in effect.
In Windows 2000, account lockout is urgently replicated to the primary domain controller (PDC) emulator role owner and is then urgently replicated to the following:

  1. Domain controllers in the same domain that are located in the same site as the PDC emulator.

  2. Domain controllers in the same domain that are located in the same site as the domain controller that handled the account lockout.

  3. Domain controllers in the same domain that are located in sites that have been configured to allow change notification between sites (and, therefore, urgent replication) with the site that contains the PDC emulator or with the site where the account lockout was handled. These sites include any site that is included in the same site link as the site that contains the PDC emulator or in the same site link as the site that contains the domain controller that handled the account lockout.

In addition, when authentication fails at a domain controller other than the PDC emulator, the authentication is retried at the PDC emulator. For this reason, the PDC emulator locks the account before the domain controller that handled the failed-password attempt if the bad-password-attempt threshold is reached.

So to summarize, as bad password attempts are prioritized and every bad password attempt is also retried at the PDC emulator, your account will be locked out by any properly replicating domain controller.

There are however a few exceptions that might allow you more than your allotted amount of logins:

  1. Mixed Environments with Windows NT Server 4.0 and Active Directory Domain Controllers
  2. Inputting a recent password does not increase the bad password count
3
  • Is it possible you mean PDC FSMO role holder instead of primary domain controller? – GregL Aug 27 '15 at 14:17
  • @GregL Yes, correct, I'll update my wording. – Reaces Aug 27 '15 at 14:18
  • It is not due to replication, but rather the failed logon attempt is retried at the PDC emulator. When the PDCE reaches the threshold, the account will be locked out. It is the account lockout is urgently replicated, not the failed logon. If the PDCE is not reachable, the threshold is on the local DC. – Greg Askew Aug 27 '15 at 14:19
3

It is theoretically possible for a user to exceed the maximum number of login attempts defined by policy. (Especially by using password change attempts.)

For instance, say your lockout policy is 5 bad login attempts.

A user could attempt 4 logins against DC1,

then they could attempt 4 logins against DC2,

and still not get locked out after the first bad login attempt against DC2.

From https://technet.microsoft.com/en-us/library/Cc772726(v=WS.10).aspx, which is essential reading for all AD admins:

When a bad password is used in an attempt to change a password, the lockout count is incremented on that domain controller only and is not replicated. As such, an attacker could try (# of domain controllers)*(lockout threshold -1) + 1 guesses before the account is locked out. Although this scenario has a relatively small impact on account lockout security, domains with an exceptionally high number of domain controllers represent a significant increase in the total number of guesses available to an attacker. Because a user cannot specify the domain controller on which the password change is attempted, an attack of this type requires an advanced tool.

Also this:

In addition, when authentication fails at a domain controller other than the PDC emulator, the authentication is retried at the PDC emulator. For this reason, the PDC emulator locks the account before the domain controller that handled the failed-password attempt if the bad-password-attempt threshold is reached.

So normally, you will not see a regular every day user exceeding the lockout threshold, but it is possible to exceed the defined lockout threshold with an automated tool that's fast and can outpace AD replication.

Key takeaway here is that urgent replication doesn't mean instantaneous replication.

3
  • @Reaces You just weren't using the right tools. :) – Ryan Ries Aug 27 '15 at 14:28
  • So I guess your point is that you could game the system by doing password resets! Nice addition, I did not know that, but I also didn't really interpret the OP the same way you did it seems, +1 though! – Reaces Aug 27 '15 at 14:30
  • @Reaces Agreed, I think I just interpret OP's question to mean what I want it to mean so that I can form an interesting answer, where interesting = hack all the things. :) – Ryan Ries Aug 27 '15 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.