User account Locked out each time when attempt to login

[Nisha30]

Hello Experts,

Need some help. In our TEST instance there are specific Users who are unable to login . We tried reset password but each time when they try login the account gets locked out. I inactivated the BR (Locked Out) still its getting locked.

Users are having ITIL role. We have LDAP user import but I am thinking this is TEST system so does it matter? Also I checked out event logs and looked for login.failed but cant get anything more why they are unable to login???

Can anyone please help where to look and troubleshoot please . Not aware of LDAP scenarios if somewhere to look at ?

Please guide.

Thanks

Nisha

[Allen Andreas]

Hi,

Interesting...please review this documentation and see if it helps: https://docs.servicenow.com/bundle/paris-servicenow-platform/page/administer/security/task/t_Lockout...

You can also review your system policy > event logs and look for the "login.failed" event with their name to see if they've attempted again and are simply just using the wrong password.

As far as the link I posted, that's about the limit for lockouts, but the system property, out of box, should be set to reset after 15 minutes. Perhaps it's not resetting or you changed the value?

Please mark reply as Helpful/Correct, if applicable. Thanks!

[Nisha30]

Strange thing is I have deactivated all BR and Transform scripts wherever locked_out=true is written just for testing. Also LDAP servers in TEST instance are not working (understandable). Even though when  a user tries to login it gets locked out and in HISTORY AUDIT I see = Guest Account  ??? why it is guest account even though the user is present in sys_user table and for sure the user ID is not Guest. Banging my head why it is not allowing .

Thanks,

Nisha

[Allen Andreas]

Hi,

It may be "guest" because they can't really authenticated yet or something. Not sure. Can you double-check their user credentials that they're using. Appropriate user_id, etc. are you using SSO?

Or are they logging in like https://instancename.service-now.com/login.do

Please mark reply as Helpful/Correct, if applicable. Thanks!

[Nisha30]

yes we have SSO but in TEST we are not mandate for SSO so they are using https://instancename.service-now.com/login.do

[Allen Andreas]

Understood. So then it would use their account user id and password.

I'm going to just say that this is user error. On their end.

I don't think they're using the right password and they keep typing it wrong or something to that effect.

If you'd set their password to something simple, just to get them in, without checking "password reset on login", just to get them in, it should be fine.

Otherwise, it's their own issue where they aren't logging in correctly.

You could reset the password, set their user account to active, not locked out, no password reset on login, and you yourself test it and it should be fine.

Please mark reply as Helpful/Correct, if applicable. Thanks!