Home / server / Questions / 247851
Accepted
Bob
Asked: 2011-03-16 11:27:42 +0800 CST

Can I prevent an Active Directory account from locking out?

  • 772

Is there an ADUC setting that can prevent certain user accounts from locking out, particularly after x number of failed logon attempts? Oh and our DC is on Server 2003 at the moment, but we also use Server 2008 DC's in other environments.

windows active-directory

4 Answers

  1. Best Answer

    You can do it but you still need a GPO. Create a GPO that has the necessary settings, then eliminate the "apply group policy" right from the ACL. Create a group that you want to have eliminated from password lockouts, add your user(s) to the group, and assign that group the "apply group policy" right for your GPO.

    Remember that GPOs are applied in the following order:

    Local Site Domain OU

    so be sure to apply your new GPO at the correct level so it's not stomped on by something below it.

    • 2

  2. A preferred approach would be to move off of your Windows Server 2003 DC's and configure your domain for Windows 2008 functional level, you will be able to take advantage of one of the new features of Windows Server 2008: multiple password and account lockout policies.

    AD DS Fine-Grained Password and Account Lockout Policy Step-by-Step Guide
    http://technet.microsoft.com/en-us/library/cc770842%28v=ws.10%29.aspx

    How to raise Active Directory domain and forest functional levels
    http://support.microsoft.com/kb/322692

    • 1

  3. You should ask this on serverfault.com, although a quick answer is http://technet.microsoft.com/en-us/library/cc781491(WS.10).aspx

    • 0

  4. I can't help but wonder why you don't simply allow blank passwords for those accounts. It's near enough the same (lack of a) security level as allowing unlimited attempts. Alternatively, you can either apply a separate GPO to those accounts that allows the maximum number of password attempts (whatever that number might be) or simply set as short a lockout time period as possible so that the account unlocks quickly enough that they don't really notice.

    Of course the ideal solution would be to get these people to actually remember their passwords but I'm guessing these are senior managers.

    • 0