tmaxlntr =X setting failed to stop a login session after X consecutive unsuccessful logins allowed

[AllianceOneDevS]

Our partner having Vintela Authentication Service protocol & Name Service Switch (NSS) as back end, has a Problem in restricting the user after the max number of consecutive unsuccessful logins allowed per terminal.
But this works for local users.
tmaxlntr=X, setting ignored when VAS users log in they can fail multiple times, more then X, and not have the session closed.
( never seen it closed for them ).
Partner wants to know how "tmaxlntr" interaction works, how the authenticating program keeps track of failed attempts to know to cut it off.
If there is a change in the prpasswd struct for the user logging in that accomplishes this, or if there is another mechanism at use, if so what it is.

Thanks in advance

sharan