Account Lockout Problem

[Andy Mac]

Ive been having a problem in Active Directory where a user can have his
account locked out whilst being already logged on to the network.

It appears to happen when a user opens up IE, which is set to the intranet
home page running on IIS5. Then the user can browse other internet websites,
then come back to the intranet, or any other network service and the account
will be logged out

I personally have had this occur when I opened up IE locally (we have the
option of Citrix or local IE) and opened up our helpdesk app which is stored
on the same server as the intranet. It immediately prompted me for a logon,
which after 1 try, locked my account out (our password lockout is set to 3
trys)

We do have Intergrated Windows authentication switched on in IIS5. This has
only happened to 2 people that we know of so far, all using windows XP SP1.

The lockout has happened to 2 other people, but we are not too sure of their
actions prior to this.

Both DC's are on w2kSP3, the IIS server is on w2kSP2. All the users in
question have not been logged on to any other machine at the time of lockout

Thanks

Andy

 

[Tim Hines [MSFT]]

Take a look at the following resources

Account Policy whitepaper

http://www.microsoft.com/technet/tr...ndowsserver2003/maintain/operate/BPACTLCK.asp

Account lockout management tools

http://microsoft.com/downloads/deta...9C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

Account Best Practices

http://www.microsoft.com/technet/tr...oddocs/entserver/windows_password_protect.asp

Account Lockout Webcast

http://support.microsoft.com/default.aspx?scid=/servicedesks/webcasts/wc022703/wcblurb022703.asp


--
Tim Hines, MCSE, MCSA
Windows 2000 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.