• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1901
  • Last Modified:

How do I stop users accounts getting locked out?

This is a tricky one, since the users are non-domain users, so work LOCALLY from their laptops and not logging into a domain as such. I have ,however, created them accounts in AD in order allow them access to our domain. Basically, they are guests who have their own domain, but obviously cant use or login once they enter our site, but they need to use our printers, access the network resources, etc. I normally get them to do this by Start>Run> type ip address of the domain controller

This then asks them to authenticate their username and password (which I have provided them with). But surprisingly on the first attempt it locks their AD account! I read somewhere its something to do with caching their password somewhere.

Please can someone help, its not affecting everyone, but its really annoying as I cant seem to nail down why its just affecting one user (esp since to my knowledge there are no local policies setup to do this).

thanks
0
k3t4n_uk
Asked:
k3t4n_uk
  • 6
  • 6
1 Solution
 
meugenCommented:
which is the time difference between clients laptops and the nearest DC?
0
 
k3t4n_ukAuthor Commented:
there is no time difference. they are sitting in the same building as the DC.
0
 
slam69Commented:
My guess would be the password has expired by the time they need to use it again, but as they dont log into the domain they dont get the option to reset it. you could try setting the password to never expire or alternatively increase length of password age
0
Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

 
k3t4n_ukAuthor Commented:
I dont want to increase the length of password age in Group policy, as this will prevent users from changing passwords the same day using Outlook Web Access. I had this issue a couple of days ago.

As a result, I havent enforced any Account Lockout policies, and have left them undefined.

Any other ideas?
0
 
slam69Commented:
you could try stopping credentials being cached but cant see that helping the situation

check teh stored passwords section of users and computers in advanced hit manage passwords...anything showing in their?
0
 
k3t4n_ukAuthor Commented:
sorry not sure i follow. are you referring to Active directory?
0
 
slam69Commented:
sorry no not ad if you go to teh control panel on the machine their is an applet in ther called users and computers have a look in there
0
 
k3t4n_ukAuthor Commented:
oh ok. I see. but unfortunately, nothing in there im afraid. One thing I did see however, is that there are various local security lockout and account password policies. Please can someone advise if this is the issue or not.
0
 
slam69Commented:
you would expect there to be account password policies, however can you be more specific as to what you have being enforced
0
 
k3t4n_ukAuthor Commented:
Under Control Panel, Administrative Tools>Local Security Policy

Account Policies
-------------------------
enforce password history=24 passwords remembered
maximum password age=30 days
minimum password age=0 days
min password length=6 chars
password must meet complexity requirements=enabled
store pass usign reversible encryption=disabled

Account lockout policy
----------------------------

Account lockout duration=not applicable
Account lockout threshold=0 invalid logon attempts
Reset account lockout counter after=not applicable



Any ideas???


0
 
slam69Commented:
Yup increase the account lockout threshold to 3
0
 
k3t4n_ukAuthor Commented:
would this prevent them getting locked out?

they are using start>run

then entering the ip address of the DC. This usually works for them, and prompts for username and password. Lately, its just showing as 'you do not have access to this resource. please see administrator'. Basically words to that effect. If this local policy setting is causing it, shall i change it for all users?
0
 
slam69Commented:
think its worth a try otherwise they get locke dout straight away Im not 100% this will work but its the next thing to try
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 6
  • 6
Tackle projects and never again get stuck behind a technical roadblock.
Join Now