Configuring and Synchronizing Account Lockout and Unlockout

To enable the Account Lockout feature, you must do the following:

• Make the Password policies same on both Active Directory and Directory Server.

• Enable Account Lockout.

• Map certain attributes, which are different in Directory Server and in Active Directory

Identity Synchronization for Windows can synchronize the following events between Active Directory and Directory Server:

• Lockout events from Active Directory to Directory Server

• Lockout events from Directory Server to Active Directory

• Manual unlockout events from Active Directory to Directory Server

• Manual unlockout events from Directory Server to Active Directory

Account lockout and unlockout synchronization is not supported on Windows NT directory servers.

Prerequisites for Account Lockout

The attribute lockoutDuration should be set to the same value at both the places before enabling the account lockout feature. Make sure that the system time is also uniform across the distributed setup. Otherwise, the lockout events can expire if the lockoutDuration is less than the difference in the system dates.

Set the symmetric password policy at both ends. For example, if the password policy at Active Directory signifies a permanent lockout then the same password policy should be set at Directory Server.

Using the Account Lockout Feature

Enable Account Lockout Synchronization between Directory Server and Active Directory.

No explicit mapping of the pwdaccountlockedtime (Directory Server) and lockoutTime (AD) attributes is required to enable account lockout. Select Enable Account Lockout Synchronization from the Account Lockout tab in Identity Synchronization for Windows configuration panel.

You can enable or disable the account lockout synchronization using command line tool idsync accountlockout. For more information, see Appendix A, Using the Identity Synchronization for Windows Command Line Utilities.