AD Account Lockout

Hi @bailz564,
if your user’s account get locked, it might be due to the “Account Lockout Policy” of your Domain Controller’s GPO.
You can find the corresponding group policy below
Computer Configuration > Windows Settings > Security Settings > Account Policies >Account Lockout Policy.

From NADI’s side, there is nothing we can do. You could either use a custom WordPress solution to prevent brute force logins or configure the corresponding GPO.

Hi schakko,

Yes, it is absolutely down to the Account Lockout Policy but I’m more interested in why NADI is attempting to authenticate roughly every 30 minutes and eventually causing these lock outs.

When testing with my own account, I am logging in to WordPress with my current password but yet my account is locked out 3 or 4 times a day by failed authentication attempts from the WordPress server.

NADI itself does not store your password (aside from the required service accounts for Sync to WP/AD – which you are not using).

– Are you using some tools like Windows Live Writer which periodically logs in into WordPress/NADI?
– Does NADI’s debug.log shows any suspicious activity?

We are not using anything like Windows Live Writer.

I see nothing that I wouldn’t expect to see in the debug.log. Although I only just enabled this after your earlier message. It only appears to log each time a user logs in.

I have since disabled the NADI plugin and the authentication attempts and lockouts have stopped. I haven’t seen any auth requests hitting our DC in the last hour.

@bailz564
NADI is responsible for doing the authentication but there does nothing exist like an automatic login procedure.

My 2nd guesses would be
– Some other plug-ins which are firing WordPress ‘wp_authenticate’ hook (which NADI is listening to)
– Browser plug-ins which are trying to re-authenticate (which triggers NADI’s authentication)

Some further questions:
– Are there any other WordPress plug-ins installed which have to do with security-related topics?
– Do you have checked in which intervals (e.g. every 120 minutes) those re-authentications happen?
– Can you correlate the authentication with some HTTP requests (e.g. by comparing the timestamps with Apache’s access.log)?