account lockout gpo

[Julie]

I had the account lockout policy enabled for the default
group policy for the domain but clients were getting
locked out when they had not even reached the limit. Some
accounts were disabled after one attempt. I quickly
removed those policy settings but it still occurs. Any
help would be appreaciated. We are running W2K Advanced
Server SP3.

Thanks in advance

 

[Herb Martin]

I had the account lockout policy enabled for the default
group policy for the domain but clients were getting
locked out when they had not even reached the limit. Some
accounts were disabled after one attempt. I quickly
removed those policy settings but it still occurs. Any
help would be appreaciated. We are running W2K Advanced
Server SP3.

This just doesn't happen -- ok, any bug is POSSIBLE, but we just
don't hear this one very often.

Turn on Account Logon Auditing and count the failures.

Remember it is not "logons" that really matter but rather
AUTHENTICATION failures.

What are your settings for the Lockout elements?

 

[JUlie]

Thanks for the response Herb. I already enabled autditing
and have several failed authentiation errors that is what
has be worried. The only settings I had the following
settings applied
lockout after 5 unsuccessul logon attempts and I had it
set to unlock after 30 minutes.
I am baffled.
Thanks,
Julie

 

[Herb Martin]

Thanks for the response Herb. I already enabled autditing
and have several failed authentiation errors that is what
has be worried. The only settings I had the following
settings applied
lockout after 5 unsuccessul logon attempts and I had it
set to unlock after 30 minutes.

What is the counter reset value? (5 unsuccessful attempts
with each one expiring after 10 minutes, 2 hours, 1 day?)

Many people incorrectly think that a successful logon resets
the counter -- it does NOT!