Dear all , we using window 2008 server in my office , now we have problem with group policy we create password lock group policy for all users if user enter 3 time wrong password means that user cant access his account without administrator unlock permission but all the user account lock without 3 time enter wrong password... plz give me idea for that

you mean the users accounts are getting locked without typing the wrong passwords ? If its the above scenario then use should use account lockout tools to analyze the problem http://www.windowsitpro.com/article/tips/tools-for-troubleshooting-locked-out-accounts http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=18465 http://www.virmansec.com/blogs/skhairuddin

Check this similar thread. For GPOs queries, post here. http://social.technet.microsoft.com/Forums/en-US/winserverGP/threads/ Thanks

Also, take a look at the Security event log on the domain controller and search for event ID 4740. Event 4740 is logged when a user account is locked and one of the useful things it will tell you is from what server the lockouts are coming from. Knowing the server is useful as it can tell you a lot about the source of the lockout. Here's some examples: Lockout source is the domain controller: Can occur if the user gets their password wrong a number of times in a row (whatever your threshold is set to) Can occur if the user changes the password on one computer while still being logged on to another Lockout occurs on a TMG/ISA server: Commonly occurs when the user has changed their password at their computer but has fogotten to change it on their ActiveSync-enabled phone/device (or competitive product) Lockout occurs on an IIS server: A web application impersonating the user is still running So, as you can see, there's a number of examples where a user account can become locked other than them getting it wrong while typing it in a few times. Cheers, Lain