I recently set an account lockout policy
but was told to remove it after to many users complained.
I went in to the default domain policy and reset the
lockout policy to not defined but people were still
getting locked out after 3 incorrect logon attempts.
I then realized that I should set the policy to
zero invalid attempts because the policy then says
"Account will not lock out" To test that I logged
off and purposely tried to get locked out and it still
locked me out after 3 tries.

Do I need to wait a certain amount of time for the
policy to take effect? We only have 2 domain controllers
in a mid-sized business.

Any help would be greatly appreciated.

Thanks,
Jeff Parrish

After the change run secedit /refreshpolicy machine_policy /enforce on first the
domain controller and then on a domain machine to see if it helps. My guess is that
it may already be working by the time you read this reply anyhow. --- Steve


http://support.microsoft.com/default...b;EN-US;227302

"Jeff Parrish" <(E-Mail Removed)> wrote in message
news:17afb01c44974$fb574110$(E-Mail Removed)...
> I recently set an account lockout policy
> but was told to remove it after to many users complained.
> I went in to the default domain policy and reset the
> lockout policy to not defined but people were still
> getting locked out after 3 incorrect logon attempts.
> I then realized that I should set the policy to
> zero invalid attempts because the policy then says
> "Account will not lock out" To test that I logged
> off and purposely tried to get locked out and it still
> locked me out after 3 tries.
>
> Do I need to wait a certain amount of time for the
> policy to take effect? We only have 2 domain controllers
> in a mid-sized business.
>
> Any help would be greatly appreciated.
>
> Thanks,
> Jeff Parrish

Thanks for replying, it's working great now.

>-----Original Message-----
>After the change run secedit /refreshpolicy
machine_policy /enforce on first the
>domain controller and then on a domain machine to see if
it helps. My guess is that
>it may already be working by the time you read this
reply anyhow. --- Steve
>
>
>http://support.microsoft.com/default.aspx?scid=kb;EN-
US;227302
>
>"Jeff Parrish" <(E-Mail Removed)> wrote in message
>news:17afb01c44974$fb574110$(E-Mail Removed)...
>> I recently set an account lockout policy
>> but was told to remove it after to many users
complained.
>> I went in to the default domain policy and reset the
>> lockout policy to not defined but people were still
>> getting locked out after 3 incorrect logon attempts.
>> I then realized that I should set the policy to
>> zero invalid attempts because the policy then says
>> "Account will not lock out" To test that I logged
>> off and purposely tried to get locked out and it still
>> locked me out after 3 tries.
>>
>> Do I need to wait a certain amount of time for the
>> policy to take effect? We only have 2 domain
controllers
>> in a mid-sized business.
>>
>> Any help would be greatly appreciated.
>>
>> Thanks,
>> Jeff Parrish
>
>
>.
>