I have a control requirement:

AC-7 Unsuccessful Logon Attempts The information system must define and enforce a limit on the number of consecutive invalid login attempts by a user. And it should: automatically locks the account for a defined time period; locks the account until released by an administrator; or delays next login prompt, when the maximum number of unsuccessful attempts is exceeded.

but it seems that the user account lockout policy comes from the Active Directory policy, there is another way of setting it on SharePoint?

1 Answer 1


This is an Active Directory security policy, SharePoint can not override it, and please note authentication has been done through active directory. So there is no SharePoint role in account locking.

I will suggest, please check the AD / LDAP policy / rules again to ensure the login .

Please check out this How-To identify the source of Account Lockouts in Active Directory for further help.

Additionally, you could also take a look on this troubleshooting account lockout which explains few common root causes of account lockouts and how to resolve them.

  • 1
    To be even more clear, SharePoint performs AuthZ, not AuthN. AuthN is taken care of, in Windows Classic/Claims mode, by IIS. In SAML, by the IdP (such as ADFS), etc.
    – user6024
    Commented Sep 20, 2017 at 14:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.