12 Oct 2003:

Some of you may have noticed that you can't logon to Windows 2000 because your account is locked out. For those of you attempting to login to the Repository Server (cssgate) and other Unix systems, you may notice that the system keeps prompting you for a password, even though you've entered it correctly; your Windows account, which authenticates you to Unix systems, could either be locked out or the password has expired.

In both cases, the account lockout security policy may be responsible. It is working to protect your account from being hacked into. The policy is set to temporarily refuse further login attempts after a few unsuccessful login attempts. After a few minutes (currently, about ten (10) minutes, but this may change), it should allow logins again.

Account lockout is most often triggered by:

1. typing the wrong password a few times.

   If you've forgotten your password, please see one of the lab staff. Otherwise, see lab staff to unlock it immediately, or, outside of lab staff office hours, please wait and try again.

2. some computer program or person attempting to guess your password.

   This is not a mistake and is a "bad thing"; someone could try to impersonate you, or copy or delete your files by using your account. This is why it is important to use long, not-easily-guessable passwords. Other policies enforce requirements for long passwords and expire the passwords after a few months.

   The labs computers are constantly being scanned for vulnerabilities from computers both inside and outside of the UW. Attempting to use existing accounts is one of the easiest ways to start to control a computer. We look into these attempts and try to find the source and report them to the owners of the computers used, as they may not be aware that their computers have been "compromised".

   Some unauthorized login attempts could be blocked by better network control. We have plans to do this, but in the meantime, please follow the above suggestions.