For my organization of around 6000 users, I just did three things.

  • Set "Default Domain Policy" password requirements to "not defined"
  • Set a Fine Grained Password Policy for your basic 8 characters w/ complexity for Domain Users
  • Set a Fine Grained Password Policy for IT (in the IT group, about 100) with more strict rules, and gave it higher priority

The reason I have a FGPP for Domain Users is so I can adjust the priority.

Since then, I've had zero issues with the majority of my 6000 users. However, about a dozen of the IT employees are having their accounts locked out the moment they lock their screens and try to log in again.

I've used lockoutstatus.exe and see that bad passwords are being hit against two of our three DC's, but I can't pinpoint what's doing it.

This is a separate issue, but our Event Viewer logs overwrite themselves after 20 minutes and it's difficult to sort through it, we get about a million events per hour and the event view only stores 8gigs per category. I bring this up because I can't reliably use Event Viewer on our DC's to help pinpoint this.

While we forced some users to change their password, two of the users having this issue were exempt a forced password reset, so their credentials haven't changed at all during any of this.

Any tools or tips to help me out?


If you use RADIUS authentication in your business, I had similar issue when a device, like a handheld telephone was using WIFI with AD password of the user(s).

The device was causing the account lock.

In your security event log if you can catch a error log you will see a source IP of when it happen in the account failure auditing. The IP is not set to a workstation or device as it's the local radius client on the Domain Controller that fail the audit/login.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.