asked on

How do I stop users accounts getting locked out?

This is a tricky one, since the users are non-domain users, so work LOCALLY from their laptops and not logging into a domain as such. I have ,however, created them accounts in AD in order allow them access to our domain. Basically, they are guests who have their own domain, but obviously cant use or login once they enter our site, but they need to use our printers, access the network resources, etc. I normally get them to do this by Start>Run> type ip address of the domain controller

This then asks them to authenticate their username and password (which I have provided them with). But surprisingly on the first attempt it locks their AD account! I read somewhere its something to do with caching their password somewhere.

Please can someone help, its not affecting everyone, but its really annoying as I cant seem to nail down why its just affecting one user (esp since to my knowledge there are no local policies setup to do this).

thanks

meugen

which is the time difference between clients laptops and the nearest DC?

k3t4n_uk

ASKER

there is no time difference. they are sitting in the same building as the DC.

slam69

My guess would be the password has expired by the time they need to use it again, but as they dont log into the domain they dont get the option to reset it. you could try setting the password to never expire or alternatively increase length of password age

k3t4n_uk

ASKER

I dont want to increase the length of password age in Group policy, as this will prevent users from changing passwords the same day using Outlook Web Access. I had this issue a couple of days ago.

As a result, I havent enforced any Account Lockout policies, and have left them undefined.

Any other ideas?

slam69

you could try stopping credentials being cached but cant see that helping the situation

check teh stored passwords section of users and computers in advanced hit manage passwords...anything showing in their?

k3t4n_uk

ASKER

sorry not sure i follow. are you referring to Active directory?

slam69

sorry no not ad if you go to teh control panel on the machine their is an applet in ther called users and computers have a look in there

k3t4n_uk

ASKER

oh ok. I see. but unfortunately, nothing in there im afraid. One thing I did see however, is that there are various local security lockout and account password policies. Please can someone advise if this is the issue or not.

slam69

you would expect there to be account password policies, however can you be more specific as to what you have being enforced

k3t4n_uk

ASKER

Under Control Panel, Administrative Tools>Local Security Policy

Account Policies
-------------------------
enforce password history=24 passwords remembered
maximum password age=30 days
minimum password age=0 days
min password length=6 chars
password must meet complexity requirements=enabled
store pass usign reversible encryption=disabled

Account lockout policy
----------------------------

Account lockout duration=not applicable
Account lockout threshold=0 invalid logon attempts
Reset account lockout counter after=not applicable

Any ideas???

ASKER CERTIFIED SOLUTION

slam69

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

k3t4n_uk

ASKER

would this prevent them getting locked out?

they are using start>run

then entering the ip address of the DC. This usually works for them, and prompts for username and password. Lately, its just showing as 'you do not have access to this resource. please see administrator'. Basically words to that effect. If this local policy setting is causing it, shall i change it for all users?

slam69

think its worth a try otherwise they get locke dout straight away Im not 100% this will work but its the next thing to try