account lockout issues...

From: Brad Pears (donotreply_at_notreal.com)
Date: 07/09/04 

Date: Fri, 9 Jul 2004 12:30:15 -0400

I have a couple of question regarding the account lockout policy.

1) I had originally set a local policy on our Win2K terminal server such
that 3 invalid logon attempts would cause an account lockout.

Later on, I had applied a domain wide policy (on our SBS 2000 server) that
set it to 5 invalid attempts.

I assumed the domain policy would override any local policy but it doesn't
seem to. If a user logs on 3 times with an incorrect password, it will still
lock them out!

Also becuase we have been having problems with users being locked out, I
decided to completely eliminate the lock out. So , I disabled account
lockouts in both the domain policy on the SBS 200 server and the local
policy on the win2K terminal server.

I am still getting accounts locking out after 3 invalid attempts.

What gives? Can anyone help me?

2) Also, maybe I need a lesson on what can cause a lockout...

We have a user who brings in his home laptop to copy drawings off our server
so he can work from home.

I configured his laptop so that he has the same drive mappings he has on his
work machine. Two drive mappings point to shares on our win2K server that is
part of our domain. The other mapping points to a share that is on an older
NT 4 server - which is NOT part of the domain.

When he logs onto his laptop, he is logging on locally - not as part of the
domain. (It's winxp home edition).

When I set up his shares, I configured the appropriate domain\username and
password so it would connect. For the NT 4 share which is part of a
workgroup (not in our domain) I configured his username and password
excluding the domain.

The problem is, as soon as he logs on and double clicks one of his mapped
drives, it asks for his password and when he enters that, it says it has
locked him out!!!

Why would the account be locking out when I have specified the
domain/username and passwords to use for the drive mappings? There is only
two drive mappings that use his domain username/password. If the lockout was
set to 3 invalid attempts, why is it locking out when there are only two
mappings ???

I am obviously missing something here...

Thanks

Brad

Relevant Pages

  • Re: RWW and Remote desktop stopped working on all clients
    ... After diggin through ALL the group policies, I found Remote ... Desktop DISABLED under the Account Lockout policy - I don't think I've even ... adminsitrator or another account with Domain Admin role; also the server ...
    (microsoft.public.windows.server.sbs)
  • RE: 529 Logon Failures - 138 Events
    ... I am using complex passwords....I have not configured the lockout feature. ... Can I configure a lockout policy for the server itself? ... If I lock the server will I be able to unlock it to do maintenance? ... Configure account lockout policy. ...
    (microsoft.public.windows.server.sbs)
  • Re: Restrict to 1 program
    ... I would *not* apply the policy to the whole domain. ... Terminal Server computer account in this OU and link the policy to ... Configuration settings from the GPO linked to OU where the computer ...
    (microsoft.public.windows.terminal_services)
  • Re: Terminal Server logon problem
    ... I upgraded our current SBS 2003 box to new hardware using SBSMigration.com's ... When it was time to bring the old SBS server offiline and make ... I am getting a group policy error - You do not have permissions to ... The only thing I thought I changed was taking the administrators account ...
    (microsoft.public.windows.server.general)
  • Re: Terminal Server logon problem
    ... You had a server that was upgraded to SBS 2003? ... I am getting a group policy error - You do not have permissions to perform ... The only thing I thought I changed was taking the administrators account out ... make the user a member of the Remote Desktop ...
    (microsoft.public.windows.server.general)