blocks|key|528659|text|通常，我们告诉用户的是将设备置于“飞行”或“飞机”模式，当他们准备更改密码时切断网络访问，一旦他们在桌面/膝上型电脑上更改密码，他们就可以在设备中输入新密码并连接回网络。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|528660|当然，我们也发送过期通知，以便他们为密码过期做好充分的准备。|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|E|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|F|8|@]|9|@]|A|$]]]|D|$]]

Normally what we tell users is to put the device in "flight" or "airplane" mode, cutting off network access when they are ready to change password, once they change the password on Desktop/Laptop, then they can enter the new password in device and connect back to network.

Of course we also send the expiry notification so that they are well prepared for the password expiry.

blocks|key|3134066|text|TMG+SP2现在有了帐户锁定功能来防止这个问题。见：这里，这里和这里。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|http://tmgblog.richardhicks.com/2012/06/15/forefront-tmg-2010-account-lockout-feature-for-fba/|1|http://support.microsoft.com/kb/2619987|2|http://blog.crayon.no/blogs/janegil/archive/2012/08/07/configure_2D00_account_2D00_lockout_2D00_feature_2D00_in_2D00_forefront_2D00_tmg_2D00_using_2D00_windows_2D00_powershell.aspx^0|R|2|0|U|2|1|X|2|2^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@$A|P|B|Q|1|R]|$A|S|B|T|1|U]|$A|V|B|W|1|X]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]|K|$5|F|G|H|C|$I|L]]|M|$5|F|G|H|C|$I|N]]]]

TMG SP2 has now the Account Lockout Feature to prevent this issue.
See:
<a href="http://tmgblog.richardhicks.com/2012/06/15/forefront-tmg-2010-account-lockout-feature-for-fba/" rel="nofollow noreferrer">Here</a>, <a href="http://support.microsoft.com/kb/2619987" rel="nofollow noreferrer">here</a> and <a href="http://blog.crayon.no/blogs/janegil/archive/2012/08/07/configure_2D00_account_2D00_lockout_2D00_feature_2D00_in_2D00_forefront_2D00_tmg_2D00_using_2D00_windows_2D00_powershell.aspx" rel="nofollow noreferrer">here</a>.

blocks|key|3134105|text|我也受到这个问题的挑战。作为一种严肃的选择，我正在考虑基于证书的ActiveSync身份验证。再加上EAS策略，需要一个密码来解锁移动设备，这应该算作双因素身份验证(您拥有的东西:您的移动设备上的证书，您知道的东西:您的移动设备的密码)。这样，当密码过期时就没有问题了。希望这能有所帮助。http://blogs.technet.com/b/exchange/archive/2012/11/28/configure-certificate-based-authentication-for-exchange-activesync.aspx|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|http://blogs.technet.com/b/exchange/archive/2012/11/28/configure-certificate-based-authentication-for-exchange-activesync.aspx^0|40|3I|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@$A|L|B|M|1|N]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]]]

I've been challenged by this question as well. As a serious option I'm considering certificate based ActiveSync authentication. Together with the EAS policy to demand a password code for unlocking the mobile device this should count as two-factor authentication (something you have: certificate on your mobile device, something you know: password code for your mobile device).
This way there is no issue when the password expires.
Hope this helps.
<a href="http://blogs.technet.com/b/exchange/archive/2012/11/28/configure-certificate-based-authentication-for-exchange-activesync.aspx" rel="nofollow noreferrer">http://blogs.technet.com/b/exchange/archive/2012/11/28/configure-certificate-based-authentication-for-exchange-activesync.aspx</a>

blocks|key|3133915|text|应该由设备告诉用户身份验证失败。我认为更好的解决办法是在ios设备上为企业使用类似好的消息传递，我认为这为企业EAS提供了支持。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|entityMap^0^^$0|@$1|2|3|4|5|6|7|C|8|@]|9|@]|A|$]]]|B|$]]

Its up to the device to tell the user that authentication failed. I think a better answer is to use something like Good messaging for enterprise on the ios devices which I believe provides enterprise EAS support.

blocks|key|528596|text|这是个好问题。不幸的是，在密码更新之前，我还没有找到阻止设备尝试身份验证的方法。您唯一能做的就是将用户排除在密码策略或文档之外，如何更改设备上的密码，并在每次密码过期时提醒用户，他们需要解锁帐户。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|528597|您还可以使用脚本或程序给用户发电子邮件，告知他们的密码将在x天内过期，并包括提醒他们需要更改手机上的密码。|528598|自从我在去年11月实施了密码政策以来，我一直期待着这个问题会出现在我现在的雇主那里，但到目前为止，我的手机用户似乎已经足够精明，无需提醒就可以更改他们的密码。|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|H|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|I|8|@]|9|@]|A|$]]]|F|$]]

This is a good question. Unfortunately, I haven't come across a way for preventing the device from trying to authenticate until the password has been updated. The only thing you can do is exclude the user from the password policy or document how to change the password on their device and remind them every time their password expires and they need their account unlocked.

You could also use a script or a program to email people that their passwords are going to expire in x number of days and include a reminder that they need to change the password on their phone.

I was expecting to have this issue at my current employer since I implemented a password policy in November, but so far, my mobile users seem savvy enough to change their passwords without being reminded.

blocks|key|3134021|text|当不使用“始终更新”功能时，您可能需要测试设备(S)身份验证尝试如何运行。如果设备配置为每五分钟轮询一次，而不是一直使用最新的，并且不会导致触发帐户锁定的身份验证失败率，则这可能是一个可行的解决方法。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|entityMap^0^^$0|@$1|2|3|4|5|6|7|C|8|@]|9|@]|A|$]]]|B|$]]

You may want to test how the device(s) authentication attempts behave when not using the "Always Up To Date" functionality. If a device is configured to poll every five minutes instead of using Always Up To Date, and that does not incur the rate of authentication failures that triggers account lockout, this may be a viable workaround.

blocks|key|528855|text|这似乎是一个设备问题，因为iPhone经常使用旧的，同时不正确的密码。苹果发布了一篇关于这个问题的技术说明，承诺在iOS7：http://support.apple.com/kb/TS4583上使用更好的设备体验。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|http://support.apple.com/kb/TS4583^0|1Q|Y|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@$A|L|B|M|1|N]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]]]

This seems to be a device problem with the iPhone trying too often using the old, meanwhile incorrect, password.
Apple posted a technote on this problem promising better experience with devices on iOS7: <a href="http://support.apple.com/kb/TS4583" rel="nofollow noreferrer">http://support.apple.com/kb/TS4583</a>

blocks|key|528705|text|在Exchange服务器前面阻止防火墙上的原始IP地址|type|unstyled|depth|inlineStyleRanges|entityRanges|data|entityMap^0^^$0|@$1|2|3|4|5|6|7|C|8|@]|9|@]|A|$]]]|B|$]]

Block out the originating IP address on the firewall in front of the Exchange server

When a user changes his account password for whatever reason (read: expired), and the old password is stored in his mobile device connected through EAS. This will cause his account to lockout almost immediately - as it should according to the lockout policy defined in the AD.
It was easy to figure out that part. The hard part is keeping it from happening. I looked everywhere. Nothing.
Basically there are four parts to the puzzle: the EAS device, the TMG (ISA) server, the EAS protocol and finally the AD. None of them have a way to stop the EAS device from failing to authenticate. So I figured I'll have to come up with a clever workaround. And the only thing I could come up with is to create a group for all EAS users and exclude them from the lockout policy, which obviously defeats the whole purpose of the policy, or to educate the users to update their devices with the new passwords, which is impossible.

The question: Can you think of any other way to prevent EAS from locking out the accounts?

Environment: Mostly iOS devices all through EAS. TMG 2010. Exchange 2007. AD 2008 R2.

ActiveSync devices causing accounts to lockout

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

当用户因任何原因更改其帐户密码(读:过期)时，旧密码存储在通过EAS连接的移动设备中。这将使他的帐户几乎立即被锁定--正如它应该根据AD中定义的锁定策略那样。很容易弄明白那部分。最困难的是不让它发生。我到处找。没什么。基本上可以分为四个部分: EAS设备、TMG (ISA)服务器、EAS协议和AD。他们都没有办法阻止EAS设备无法进行身份验证。所以我想我得想个聪明的办法。我唯一能想到的就是为所有E

问导致帐户锁定的ActiveSync设备
EN

回答 8

Server Fault用户

Server Fault用户

Server Fault用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问导致帐户锁定的ActiveSync设备EN

回答 8

Server Fault用户

Server Fault用户

Server Fault用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问导致帐户锁定的ActiveSync设备
EN