How do I stop users accounts getting locked out?

This is a tricky one, since the users are non-domain users, so work LOCALLY from their laptops and not logging into a domain as such. I have ,however, created them accounts in AD in order allow them access to our domain. Basically, they are guests who have their own domain, but obviously cant use or login once they enter our site, but they need to use our printers, access the network resources, etc. I normally get them to do this by Start>Run> type ip address of the domain controller

This then asks them to authenticate their username and password (which I have provided them with). But surprisingly on the first attempt it locks their AD account! I read somewhere its something to do with caching their password somewhere.

Please can someone help, its not affecting everyone, but its really annoying as I cant seem to nail down why its just affecting one user (esp since to my knowledge there are no local policies setup to do this).

thanks
k3t4n_ukAsked:
Who is Participating?
 
slam69Commented:
Yup increase the account lockout threshold to 3
0
 
meugenCommented:
which is the time difference between clients laptops and the nearest DC?
0
 
k3t4n_ukAuthor Commented:
there is no time difference. they are sitting in the same building as the DC.
0
Protect Your Employees from Wi-Fi Threats

As Wi-Fi growth and popularity continues to climb, not everyone understands the risks that come with connecting to public Wi-Fi or even offering Wi-Fi to employees, visitors and guests. Download the resource kit to make sure your safe wherever business takes you!

 
slam69Commented:
My guess would be the password has expired by the time they need to use it again, but as they dont log into the domain they dont get the option to reset it. you could try setting the password to never expire or alternatively increase length of password age
0
 
k3t4n_ukAuthor Commented:
I dont want to increase the length of password age in Group policy, as this will prevent users from changing passwords the same day using Outlook Web Access. I had this issue a couple of days ago.

As a result, I havent enforced any Account Lockout policies, and have left them undefined.

Any other ideas?
0
 
slam69Commented:
you could try stopping credentials being cached but cant see that helping the situation

check teh stored passwords section of users and computers in advanced hit manage passwords...anything showing in their?
0
 
k3t4n_ukAuthor Commented:
sorry not sure i follow. are you referring to Active directory?
0
 
slam69Commented:
sorry no not ad if you go to teh control panel on the machine their is an applet in ther called users and computers have a look in there
0
 
k3t4n_ukAuthor Commented:
oh ok. I see. but unfortunately, nothing in there im afraid. One thing I did see however, is that there are various local security lockout and account password policies. Please can someone advise if this is the issue or not.
0
 
slam69Commented:
you would expect there to be account password policies, however can you be more specific as to what you have being enforced
0
 
k3t4n_ukAuthor Commented:
Under Control Panel, Administrative Tools>Local Security Policy

Account Policies
-------------------------
enforce password history=24 passwords remembered
maximum password age=30 days
minimum password age=0 days
min password length=6 chars
password must meet complexity requirements=enabled
store pass usign reversible encryption=disabled

Account lockout policy
----------------------------

Account lockout duration=not applicable
Account lockout threshold=0 invalid logon attempts
Reset account lockout counter after=not applicable



Any ideas???


0
 
k3t4n_ukAuthor Commented:
would this prevent them getting locked out?

they are using start>run

then entering the ip address of the DC. This usually works for them, and prompts for username and password. Lately, its just showing as 'you do not have access to this resource. please see administrator'. Basically words to that effect. If this local policy setting is causing it, shall i change it for all users?
0
 
slam69Commented:
think its worth a try otherwise they get locke dout straight away Im not 100% this will work but its the next thing to try
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.