SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working with a web admin who has recently improved our WSS 3 deployment such that selected user OUs (e.g. service accounts, domain admins) in our Active Directory forest are explicitly unauthorized for access to anything in it.

However, that still leaves user accounts in those OUs open to a lockout attack because WSS still attempts to authenticate the user before it discovers that it will not be authorized.

How can we configure this deployment to specify certain OUs as unable to authenticate, such that attempting to auth as a user in that OU will behave the same as if you'd attempted to authenticate as a user that wasn't in the forest at all?

share|improve this question
up vote 1 down vote accepted

Firstly, you cannot stop lockout attacks. Remember that if you have a user's username, you can do a lockout attach from any machine by just trying to log on multiple times with the same password.

That being said, what you want to do here is to create a domain group which contains all the users you want to allow access for and only add that group to the sharepoint site visitors group. Other users when browsing to the site will just get a access denied error message.

share|improve this answer
We've already got the access restricted, but I was hoping for a way to get WSS to ignore forbidden OUs altogether. Your answer bears out what my research has hinted at: there isn't one. Thanks for your time. – Eric Kolb Feb 14 '13 at 18:00
There is a way... You can create a custom HttpModule to intercept all requests, check the requesting User's OU and then stop the request/redirect before Sharepoint tries to auth the user. You'd have to put your Module at the top of the calling tree though. – Fox Feb 15 '13 at 8:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.