Failed login attempts

[TeleFragger]

Ok so can I set how many attemps there are to get a failed login to the CMS page? We use the option in IE to use current user; however, for us to go to 8.5RU2, we have to get quality to pass certain things. They want to see it fail on bad attempt and i can do that after 3 failed attempts. That got me thinking... where is this setting? is CMS utilizing AD or is there a setting as I cant find it?

 

thx.

[Alex Hedley]

So are you using Windows Auth against Altiris in IIS so it passes thru or are you forcing users to the /login.aspx page?

[TeleFragger]

AD authorization.... typically we have ie settings to use current user login info

[Alex Hedley]

I’m not sure if I’m missing something but if it’s pass thru it should have the correct password since you aren’t typing in your username/password. The only time I’ve seen it not work was if your password was due to expire or it had been locked out due to incorrect login attempts on other systems. So usual AD issues. https://stackoverflow.com/questions/1003777/asp-net-iis-windows-authentication-setting-max-attempts-and-redirecting

[TeleFragger]

ok so lets back up so were all on the same page.. LOL..

 

currently for normal every day usage... we have IE use the setting to use current username/pwd.

for our new environment coming up, we run "scripts" which are test sets to prove things... one of them is the login security. With that... I change IE to ask for username/pwd.

That works..i can get the login window and just hit enter 3 times and it comes up and says.. access denied.. so that works..

my quesion here, is ... where can I see this setting? lets say I wanted it to be 5 invalid attemps vs the default 3 or is this something built in and cant be seen/changed?

we have to tell our QA in the script... access denied after 3 failed attempts. They asked if it can be 5 or 8 or 2, etc.. i cant find the setting so I cant answer it.

[Igor Perevozchikov]

Notification Server has functionality with internal accounts where you can set how many failed logons can be performed by internal account login.

 

1. To enable this functionality and see it in Symantec Management Console on Accounts Management page, you should set this coresetting

<customSetting key="ShowInternalCredentials" type="local" value="1" />

2. Now in Symantec Management Console you can create an internal account and set required password/logon settings for them.

• In case of Windows local/domain accounts usage , amount of failed logins to webpage(s), aren't controlled by NS itself. For example, if you will try failed auth attempts via Chrome browser, then it allows do this as much as possible, but I.E throws 401 error after 3rd login attempt.

Best regards,

IP.