Outlook - Active Directory Problem 1

[jgroh9]

Hello,
First, I am not sure if this is the correct forum or not.
I am having a problem setting up outlook on a common pc utilized by a bunch of people. The problem is that everytime outlook opens it needs to prompt the user for their username and a password. This is not a problem and works fine. The problem is when the user types their password in wrong there Active Directory account becomes locked. Which means after they log off of the pc they can no longer log back on until an administrator unlocks there account. Active Directory is set to allow 3 bad password attempts so I have no idea why the users account would be locked after typing the wrong password in to access their outlook email account.
Does anyone have any ideas?

 

[zeveck]

Is the problem you're having that it is locking them out after a single attempt? Or that you don't think Outlook should be causing their "actual" account to become locked?

If the workstation is logged into the domain such that it must prompt the user for their AD credentials to access their Outlook account then logging into Outlook is the same as logging into a computer is the same as doing any other AD authentication and will lock the account just the same.

 

[jgroh9]

zeveck,
The problem is that the users account is being locked after a single attempt.

Active Directory is set to currently allow 3 bad password attempts before locking a user out. However, as soon as someone enters 1 bad password into outlook it locks their AD account.
Do you have any idea why?

 

[zeveck]

I found this, which might explain it:

http://www.msusenet.com/archive/index.php/t-2561413.html

Evidently Outlook will try to authenticate through multiple channels and quickly burn up the 3 attempts even for one password entry.

Really, 3 attempts is an outdated notion. I keep my system set to 15 bad attempts. The whole point in lockout is hinder guessing / brute force attacks. Guessing is a problem, and the more guesses somebody gets the more likely to get it; but in practice most such attacks are automated and use a dictionary or some such and ANY lockout becomes effective because dictionary attacks just don't work when they can only do 15 tries every 30 minutes or whatever.

 

[asktheman]

Try resetting the users password in AD. this will for a Sync in AD/Exchange, then log the user out and in. You can also use the accountinfo tool from MS web site to monitor what is happening on the user pc what this is happening. I have this once before and found that the MS snyc manager file in windows was causing this. copying the same file from another client fixed this. But I would try resetting the users password first.