Denial of Access locks a user account after a defined number of consecutive failed login attempts. All locked-out accounts, together with failed attempts that could not be matched to an existing account, appear in a dedicated list from which lockouts can be reset. The maximum number of failed attempts and the lockout duration are configured under "Number of attempts" in Configuration Manager - Security.
Denial of Access
The list records every failed login attempt that leads to a lockout. When an attempt cannot be matched to an existing user account, the entered login name is logged instead of a user reference.
By default, a lockout lasts 30 minutes. Both the number of failed attempts allowed and the lockout duration are set under "Number of attempts" in Configuration Manager - Security.
A failed login always displays the same generic message, regardless of whether the login name does not exist, the password is incorrect, or the account is locked. This prevents an attacker from inferring from the system's response whether a specific login name exists (user enumeration).
Functions
-
Reset Selected Login Attempts – removes the selected entries from the list and lifts the lockout for the corresponding accounts.
-
Reset Unknown Login Attempts – removes all entries that could not be matched to an existing user account.
-
Reset All – removes every entry from the list and lifts all active lockouts.
Denial of Access applies only to local authentication. When single sign-on (SSO) or another external identity provider is used, lockouts are managed by that identity provider instead of by this function.
Global Functions and Related Topics
Configuration Manager - Security