Versions Compared

Old Version 2

changes.mady.by.user Ashley Irawan (Unlicensed)

Saved on

compared with

New Version 3

changes.mady.by.user Ashley Irawan (Unlicensed)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

(info) What are Account Lockouts?

  • Account lockouts happen when a user unsuccessfully attempts to log in 5 or more times consecutively.

  • When a user is locked out. the account lockout lasts for 21 minutes and prevents them from logging in or setting a new password.

  • The account lockout timer does not reset upon another unsuccessful log in attempt nor does the timer extend longer than 21 minutes. Meaning a lockout will always be 21 minutes.

  • Accounts can get locked out repeatedly if there are devices attempting to log into the system. This happens quite a bit to people that have their credentials saved when connecting to the Wi-Fi.

  • Automatically connecting to the university's Wi-Fi (SJSU_Premier and eduroam) is the biggest culprit of a lockout after a password change.

Related Tools

Excerpt
nameTR-Unlock Account Tut
Panel
bgColor#F4F5F7

(info) Tutorial

✅ Identify an Account Lockout

Expand
titleView

Using LDAP, look up the customer and find the lockoutTime variable

There are 3 different states this variable has.

Unspecified: This means that the user has been locked out before but is currently not locked out of their account.

Some specified time: This means that the user was locked out at that specific time and will automatically be unlocked 20 minutes from that time.

The variable does not exist: This means the user is not locked out and has never been locked out.

Info

A lot of the time people will try to change their password when they are locked out

You want to check if their pwdLastSet time is within the lockoutTime variable.

If it is, the user attempted to set a password during their lockout time and will need to set a new password when they are unlocked. This password they attempted to set during their lockout time cannot be used.

🔧 Resolve a Lockout

Expand
titleView

There are 3 ways to resolve a lockout

1. Waiting out the lockout time; 21 minutes.

2. Using OKTA Admin to Unlock account (Preferred)

3. Using HDPR to unlock the users account after verifying their identity. See Password Reset Training for HDPR instructions.

Note: After consecutive lockouts you may not be able to unlock the user’s account, especially if you already unlocked their account once before very recently.