I have a control requirement:

AC-7 Unsuccessful Logon Attempts The information system must define and enforce a limit on the number of consecutive invalid login attempts by a user. And it should: automatically locks the account for a defined time period; locks the account until released by an administrator; or delays next login prompt, when the maximum number of unsuccessful attempts is exceeded.

but it seems that the user account lockout policy comes from the Active Directory policy, there is another way of setting it on SharePoint?


This is an Active Directory security policy, SharePoint can not override it, and please note authentication has been done through active directory. So there is no SharePoint role in account locking.

I will suggest, please check the AD / LDAP policy / rules again to ensure the login .

Please check out this How-To identify the source of Account Lockouts in Active Directory for further help.

Additionally, you could also take a look on this troubleshooting account lockout which explains few common root causes of account lockouts and how to resolve them.

| improve this answer | |
  • 1
    To be even more clear, SharePoint performs AuthZ, not AuthN. AuthN is taken care of, in Windows Classic/Claims mode, by IIS. In SAML, by the IdP (such as ADFS), etc. – Trevor Seward Sep 20 '17 at 14:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.