Windows Forum

Ask something
Discussion Locked

users locked out

0 helpful
7 replies

by patrick shaw

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

My school win2000 network serves 1300 pupils who frequently lock themselves out. At the moment I have to go into each user's properties in 'Active Directory Users and Computers', and remove the tick from the 'Account is locked out' box.

Does anyone know how to bulk remove this tick from all user objects in an OU container? I'm guessing that some scripting is required but I don't have much experience in that! Can anyone help?

7 replies

by rdunn

You need to alter the account policies for the "users" group (of which everyone should be a member of), and disable the function that locks out user accounts after x number of bad login attempts (you should be able to right-click the 'users' group from within AD to do this).

If you don't want to do this for everyone, you can always create a clone of the users group, make your students members of that group instead, and alter the account lock out policy that way...

I'm not sitting in frontof the server now, but I know that should get you started!

Good luck!

by akula

Use the group policy snap in in the MMC to change the policy regarding lockout. You would also be able to create a new security policy for the OU that the students are in that would define a no lockout policy.

by ntuser

Rather than turning off the automatic lockout, which would create a significant security risk to your network, you can adjust the lockout duration to reset the condition of the account after a given time period(60 min?) to reduce the effectiveness of brute-force cracking tools.

This discussion is closed to new replies.