Password Changes and Exchange Activesync AD lockouts

Question

Not sure how others are doing this but the main issue we are having arises when a user changes their password on a PC. When they change it the ActiveSync on the phone does not update automatically. It will try to authenticate with the old password and lockout the user after three tries. What are options to address this issue?

Solution

There is no good way to do this. You have a few options (that aren't really solutions as they don't fix the actual problem) that will allow you to reduce the fallout from this, but none of these will completely solve the issue. Here is what we've narrowed it down to, and what we ultimately resort to, in our organization:

A) Increase the threshold of invalid attempts; we like to keep ours pretty high (50 right now) as some people might not check their phone for an extended period (say 4-8 hours or more) of time and while we can't guarantee that they will check it before the threshold locks them out, we can at least try to increase the amount of time they have before they do get locked by having a high lockout threshold.

B) Set up a script (VB or PowerShell) that emails users warning them that their passwords are about to expire; you can also include a reminder in this email that they will need to change the password on their phones once they change it on their computers. Again, this method only partially works as I'm sure you can guess. I'd be happy to provide you the PowerShell code I've used to do this if you'd like, just let me know.

C) Exclude the group of users who use EAS from the lockout policy; This defeats the whole purpose of the lockout policy and is a great security risk so it isn't something I'd recommend, but nevertheless it is a workaround/option.

Apparently TMG 2010 SP2 and above now has an account lockout feature per this, but if you're not using TMG then that is irrelevant.

Comments

[Mathias R. Jessen]

Increase the account lockout threshold significantly (ie. 50 or so attempts), as well as the lockout duration proportionally. This way the user will have more time to update the ActiveSync device, and the longitudinal efficiency of bruteforce attempts is unaltered

[Admin]

What phones are you using? I know that we do not get this lockout effect on iPhones and Windows Mobiles but have seen it occur on some of our android devices we use with ActiveSync

[tekuser]

anybody using certificates to do this? any info on how to set this up with certs to address this issue

[Brad Bouchard]

What version of iOS and Android are these users spread out on?

[Daniel]

As Brad already said, C is the worst solution you can choose. A is something I would not consider. I know it's tough, but user awareness is mandoatory in a secure it environment. Security is meant to be complicated. If users want to be lazy, they should not use a workplace where security matters. Distilled: push user awareness