Jump to content
Welcome to our new Citrix community!

Windows account lockout

Recommended Posts

There should be information in the Syslog, which you can view and filter from the GUI.


How is your LDAP auth set up? Is it using a Load Balancer, or do you simply have multiple LDAP policies (pointing to multiple DCs) bound to the vserver?


You'll find that the requests will come from the NSIP (SNIP if load balanced), which is why they appear to come from the NS.

Link to comment
Share on other sites

  • 2 months later...

What happens is that the client enters the credentials on the netscaler login page. The netscaler then uses its credentials to do an LDAP check on the client's credentials, so yes, the LDAP request is indeed coming from your netscaler.


When a user logs in with bad credentials, it will fail on the first bound LDAP, so Netscaler will now try the second LDAP. From the domain's perspective, it just saw TWO bad logins.


If the user logs in a second time with bad credentials, that's a 3rd and 4th bad login = account locked.


That is (one reason) why an LDAP load-balancer should be used: each user login (bad) request then only causes the domain to see ONE bad login.


Bad logins should show up in the Netscaler syslog, so you might want to go take a look to see if that gives some hints.


You can monitor logins real-time by going to the CLI, then typing "shell" and then "cat /tmp/aaad.debug" (ctrl-c to stop)

  • Like 1
Link to comment
Share on other sites

  • 2 years later...
  • 3 years later...
  • 1 month later...

If anyone is still struggling with this, it's very possible that you need to add the full distinguished name and not user@domain for the bind DN that the documentation alludes to.


Bad: citrix@domain.org

Good: CN=citrix,OU=Users,DC=domain,DC=org

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...