Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SafeGuard Easy v4.50.3 Account Lockout Threshold Conflict

More than 500 workstations/hard drives in our organization have been encrypted using SafeGuard Easy v4.50.3, and as a result, account lockouts have drastically increased, providing the user with only 1 (versus 3) invalid logon attempts. Before attempting to upgrade each of our clients to SafeGuard Enterprise v5.60, which hotfix/patch/resolution can we deploy to resolve this issue? We have been able to isolate and attribute this issue solely to SafeGuard Easy v4.50.3 through extensive and methodical testing.

Environment Details:

-Active Directory Domain Functional Level: Windows Server 2003

-Active Directory Forest Functional Level: Windows Server 2003

-Default Domain Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Account
Policies/Account Lockout Policy > Account Lockout Threshold: “3 invalid logon attempts”

-500+ Windows XP Professional SP3 x86 clients

Steps to reproduce the issue:

1. Format (not quick) a workstation’’’’s hard drive and install a fresh copy of Windows XP Professional SP3 x86 from the
installation disc; absolutely no additional software is installed.

2. Join the workstation to domain; Default Domain Policy is applied.


3. Confirm that multiple accounts receive 3 invalid logon attempts before account lockout.


4. Encrypt hard drive by installing SafeGuard Easy v4.50.3; restart workstation.


5. Result: domain accounts receive only 1 invalid logon attempts before account lockout.


6. Uninstall SafeGuard Easy v4.50.3 and restart workstation.

7. Result: all domain accounts now receive 3 invalid logon attempts before account lockout.

:17527


This thread was automatically locked due to age.
  • I received a prompt reply to my inquiry from Harm Meijer in Sophos Technical Support and he wrote that the "Behavior of the SafeGuard Logon Component has been identified as the cause of this issue." The solution he provided me with has already resolved the issue on numerous workstations:

    1. Open Registry Editor.

    2. Expand HKEY_LOCAL_MACHINE > SOFTWARE > Utimaco.

    3. Create the following DWORD inside the SGLogon key: SGASCompatibility = 0

    :17593