"unsuccessful login attempts" counter; when does it get reset?

[Matt Hearn]

A silly, simple question: if I have my "unsuccessful login attempts" set to lock the account at three bad tries, how often does that counter reset?

If somebody types their password wrong twice, and then gets it right, does the counter automatically reset? What if they get it wrong twice, and just give up? Does it stay at 2 until they try again and either succeed, or lock the account?

Thanks!

[Victor BERRIDGE · Accepted solution]

Hi,
>If somebody types their password wrong twice, and then gets it right, does the counter automatically reset?
YES
What if they get it wrong twice, and just give up..
Exactly

The easy way to change the login attempts is to use SAM>users...>Action>General User Account Policies/ Unsuccessfull login Tries allowed...


All the best
Victor

[Charles McCary]

To further answer the second part of your question (Victor answered the first just fine), when they attempt to login twice unsuccessfully, yes it simply stays at two until they try again and fail (and the account would then lock) or they try again and succeed (and the counter would be reset).

thanks,
c

[Bharat Katkar]

What if they get it wrong twice, and just give up?

Here i think (not sure) if they give up and close the telnet session then it should reset. This should apply to particular session itself.

Regards,

[doug hosking]

"Here i think (not sure) if they give up and close the telnet session then it should reset. This should apply to particular session itself"

The problem with this approach is that attackers who know about this could exploit that feature, using automated login attempts, perhaps even running multiple parallel sessions trying to crack passwords, with sessions automatically restarting when they hit N-1 failed login attempts. To prevent that, it is not appropriate to reset the count for every session. It MAY make sense in some cases to reset the count after some period of time has elapsed since the last failed login attempt, but that approach in general also has problems.

Of course the perception of the 'right' answer depends on many factors such as what the risk of malicious activity is and how valuable the data on the system is.