Account lockout duration not using updated time.

We are running server 2008 r2 and have an account lockout duration setup in group policy.  Originally it was set for 30 min. but we changed it to 99000 minutes.  We've made the change several weeks ago but accounts are still using the old 30 min. lockout duration time.  I ran a rsop on several computers and they show they are using the new lockout duration time, but the accounts are still being unlocked after 30 min.  Below are the settings we use.  Any ideas?

Account lockout duration 99000 minutes
Account lockout threshold 3 invalid logon attempts
Reset account lockout counter after 5 minutes
bnussbaumAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Miguel Angel Perez MuñozCommented:
Making a gpudate /force on workstations gets new values or remain on 30 minutes?
0
bnussbaumAuthor Commented:
That didn't work.  When I run RSOP.msc on any computer they show they are using the new lockout duration time.
0
AcklesCommented:
Can you provide the value of the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

AcklesCommented:
Also, please mention what is the client OS?
It's hard to say if the whole environment is not described...

Since you have taken the RSOP, can you please also have a look at Group Policy Operational Logs? That will give you a clearer picture of what exactly is happening.

Please also check the Registry Key previously mentioned.

A
0
bnussbaumAuthor Commented:
It is a server 2008 R2 domain and all computers are running windows 7.  I have found I had to edit the local security policy on the domain controller to change this.
0
AcklesCommented:
Well, that is a start. But, what are you seeing on the clients in the registry key?
0
bnussbaumAuthor Commented:
I've check on several computer and the MaxDenials key is set to 0 and the reset time is 2800.
0
AcklesCommented:
Would you be open to try to set the Registry via Group Policy Preferences?
0
bnussbaumAuthor Commented:
Yes I can do that.
0
AcklesCommented:
Please see the link below:

http://www.grouppolicy.biz/tag/group-policy-preferences/

Go to the section:
How to use Group Policy to change the Drive Letters position in Windows Explorer

This has an example how to set the desired registry key to achieve the result. My suggestion is to isolate one machine in a OU & test on it, if you get the desired result then roll it out.

0
AcklesCommented:
Hi,
Did you get time to try?
A
0
AcklesCommented:
Any news?

A
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
bnussbaumAuthor Commented:
When I edited the local security policy on the domain controller it fixed this issue.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.