Monday, January 25, 2010

Login is locked out when enforce password policy is on

MY SQL 2005 login is set with “Enforce password policy” turn on

Check what mean by Enforce password policy:
In Start->Administrative tools->Local Security Settings
Security Settings-> Account Policies -> Account Lockout Policy

Account Lockout threshold - 5 invalid login attempts
If user keying 5 invalid login attempts, account will be lock.

Account lockout duration - 30 minutes
account will be lock for 30 min before automatically becoming unlocked

Reset account lockout counter after 30 minutes
This security setting determines the number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts

I use test as login id and keying 5 invalid password.
I try next login with correct password, I can’t login into this SQL 2005 server.





I check from Microsoft SQL Server Management Studio Server name->Security-> test
Double click on test (login name), select Status->Under
Status -> SQL Server authentication ->
"Login is locked" out is checked.

It mean my login account been locked.

I unchecked "account been locked" and press "OK".
I login with the correct password, the login still fail.
I double click the SQL login again, "account been locked" is still "checked"

I unchecked Enforce password policy, unchecked Login is locked out" and press OK.
I login with correct password, but login still fail.

Solution:
1. Change password with TSQL
-ALTER LOGIN test WITH PASSWORD = 'complexpassword',CHECK_POLICY = ON;
-I login with complexpassword, login successful

2. Change password from Microsoft SQL Server Management Studio
-Microsoft SQL Server Management Studio -> Server name->Security-> test
-Double click on test (login name)->General -> Keying new password in Password and Confirm Password and press "OK"
-Double click on test (login name)->Status ->SQL Server authentication: -> Login is locked out
-I login with complexpassword, login successful


Reference
Account lockout duration


Reset account lockout counter after

No comments: