Help with Account Lockout Threshold

Bill_A

Hi. I hope to get some help with this problem. I manage a small network with a WIN2003 server and six XP SP3 hosts. We're performing vulnerability scans and noticed the Account Lockout Threshold setting of the XP hosts all indicate 5 invalid login attempts, (and is grayed out so it cannot be changed) despite the fact the Domain Security Policy at the server is set to 3, which is what we have to see in the scan report. I even tried changing the domain policy at the server to Not Defined, and refreshed the policy, but no change with the XP hosts. I've searched the forums and have not found an answer, but saw a reference to persistent shares as a possible cause? We're current on all security patches.

Thanks.
Bill
Virginia Beach, VA

bakuryu

what are the refresh intervals set in group policy ?

__________________
Please don't click here

Bill_A

they're not configured, so the default is 90 minutes, right?

bakuryu

yes it's 90 minutes and that for domain controller is 5 minutes.

in the host xp systems, change the Group Policy Domain Controller Selection to Not Configured, then change the Account Lockout Threshold to 3 (in the host) and then again set Group Policy Domain Controller Selection to 'Use any available domain controller' or your previous setting for this policy. Check if now the account threshold is reset to 3.

Bill_A

thanks...I'll take a look first thing in the morning and let you know how I make out.

Bill_A

bakuryu,

No joy...the XP hosts still show 5 invalid logins, grayed out. There seems to be a conflicting security policy?

Bill