Lockout Policies

[Skip]

Please help!
I have set a lockout Policy to "3" failed attempts to
logon. The system locks the user out after only 2
attempts.

I turned on auditing for failed logon attempts and notice
that for every logon attempt that fails there are "2"
failed attempts in the event log. There are no drive
mappings on the computer. What could the problem be?

Thanks,
Skip

 

[IBTerry [MSFT]]

Hello,

An account lockout threshold of three is too low. This will cause nothing
but trouble for you and your end users. It would also make it very easy
for some to hit you with a denial of service attack against your domain
accounts. i.e. Someone uses a password crack tool against your network and
locks out ALL of your accounts.

I do not recommend having lockouts set less than ten is a Windows 2000/2003
domain.
What you are seeing is normal behavior. Here is an explanation from 264678.

When the client tries to authenticate the user with a resource, Windows
2000 first uses the Kerberos authentication method. If the
Kerberos attempt does not succeed, the client then tries the Windows NT
challenge/response (NTLM) authentication protocol. Each of these methods
presents the user's credentials for authentication purposes. Therefore, if
a user specifies an incorrect password, the user's account is "charged"
twice for one authentication attempt.
Netlogon logging tracks only NTLM authentication attempts. To track
invalid Kerberos logon attempts, you must use
Kerberos logging.

There are lots of other strange OS and application settings that can cause
multiple failed logons added to your lockout count.
Here is some random examples.
818078 Your User Account May Be Prematurely Locked Out
http://support.microsoft.com/?id=818078
276541 Unexpected Account Lockouts Caused When Logging On to Outlook from an
http://support.microsoft.com/?id=276541

More information...
Account Passwords and Policies
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/
security/bpactlck.mspx#XSLTsection125121120120

Hope this helps,


IBTerry [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Steve Riley [MSFT]]

Account lockouts don't solve any security problem -- they simply create an
unsustainable administrative and management burden. They also create the
situation that someone could automate bogus logon attempts against various
accounts and possibly create a logon denial-of-service for your entire
domain.

If you're worried about someone guessing the password, turn off LM and NLTM
hashes and set a strong enough password so that automated cracking attempts
will take longer than the attacker will remain alive. For example, a
24-character passphrase such as "i took my dog for a walk" will take
approximately 500,000 centuries to crack.