Dave
Mon Sep 13 10:43:50 CDT 2004
I'd up the lockout to 10 incorrect passwords. I read a support doc saying
that if a kerberos login attempt fails, the system will try ntlm, resulting
in a bad password count of 2 instead of 1. If you have reasonably complex
passwords, 10 should be more than secure enough. And, that might solve the
lockout problem while users are waiting for a new password to get applied to
the various services and resources.
Here's a great (but long) white paper on the topic of password security and
policies
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/bpactlck.mspx
"Stefan" <stefann@webmail.co.za> wrote in message
news:uDY8KRZmEHA.3156@TK2MSFTNGP12.phx.gbl...
> Hi,
>
> I implemented a lockout policy where users would be locked out for 30
> minutes if their password was entered incorectly 3 times. We had problems
> with this and I ended up having to diable this policy. I also have a
> policy where the users have to change their password every 4 weeks. But
> when they do change their password, the system allows them to login but
> denies them access to any network resource. And the next time they log in,
> the system says the account is locked out.
>
> Does anyone know of any reasons for this?
>
> Thanks
> Stefan
>