Asp.net Membership - Accounts getting locked out

Question

We're using the standard ASP.net membership features that come with asp.net.

Certain accounts in our membership database have a "Locked Out" flag set to true - when/how does this happen?

Answer 1

After a configurable number of failed logins (maxInvalidPasswordAttempts, default = 5) within a configurable length of time (passwordAttemptWindow, default = 10 minutes), the account will be locked out.

see here for membership related configuration properties

Answer 2

When someone try to login 5 times (or whatever "maxInvalidPasswordAttempts" is set to) with the wrong password the account gets locked out ...

to avoid this in the future change the attribute maxInvalidPasswordAttempts in the web.config

example :

<membership defaultProvider="SqlProvider" userIsOnlineTimeWindow="15">
<providers>
  <clear />
  <add 
    name="SqlProvider" 
    ....
    maxInvalidPasswordAttempts="the new value here "
  />
</providers>

Answer 3

These 4 guys did a great job of explaining in depth the asp.net membership controls

 <system.web>
... authentication & authorization settings ...

<membership defaultProvider="CustomizedProvider">
  <providers>
     <add name="CustomizedProvider"
          type="System.Web.Security.SqlMembershipProvider"  
          connectionStringName="MyDB"
          applicationName="MyProject"
          minRequiredPasswordLength="5"
          minRequiredNonalphanumericCharacters="0" />
  </providers>
</membership>

basically add your provider and then set the setting the way you'd like them

Answer 4

Account locking is a feature of SqlMembershipProvider that provides a safeguard against password guessing.

Looking at this page you can see that the aspnet_Membership table has IsLockedOut, LastLockoutDate, FailedPasswordAttemptCount, FailedPasswordAnswer-AttemptCount. By reviewing this table and those columns you should be able to determin who is having a failed login, when they failed on their login, and how many times they failed.

The actual count for the number of login tries can be sest in the section of the web.config. You can read more about account locking here.