Active Directory Administration Cookbook

How it works...

When adding AD FS to an environment running Active Directory, the last thing you want is for AD FS to have a negative impact on the overall information security of the environment.

AD FS adds Extranet Lockout to the Active Directory (fine-grained) password and account lock-out policies to prevent malicious persons from locking out accounts with incorrect password attempts from the internet. However, when the AD FS Extranet Lockout threshold is reached, the account cannot be used for the period of the AD FS Extranet Lockout duration to authentication to AD FS-integrated resources (while authenticating to other resources will work without a hitch).

To prevent this latter scenario, enable Extranet Smart Lockout. With this feature ...