I'm working with a web admin who has recently improved our WSS 3 deployment such that selected user OUs (e.g. service accounts, domain admins) in our Active Directory forest are explicitly unauthorized for access to anything in it.

However, that still leaves user accounts in those OUs open to a lockout attack because WSS still attempts to authenticate the user before it discovers that it will not be authorized.

How can we configure this deployment to specify certain OUs as unable to authenticate, such that attempting to auth as a user in that OU will behave the same as if you'd attempted to authenticate as a user that wasn't in the forest at all?

1 Answer 1


Firstly, you cannot stop lockout attacks. Remember that if you have a user's username, you can do a lockout attach from any machine by just trying to log on multiple times with the same password.

That being said, what you want to do here is to create a domain group which contains all the users you want to allow access for and only add that group to the sharepoint site visitors group. Other users when browsing to the site will just get a access denied error message.

  • We've already got the access restricted, but I was hoping for a way to get WSS to ignore forbidden OUs altogether. Your answer bears out what my research has hinted at: there isn't one. Thanks for your time.
    – Eric Kolb
    Feb 14, 2013 at 18:00
  • There is a way... You can create a custom HttpModule to intercept all requests, check the requesting User's OU and then stop the request/redirect before Sharepoint tries to auth the user. You'd have to put your Module at the top of the calling tree though.
    – Fox
    Feb 15, 2013 at 8:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.