Question

I am using asp.net membership provider for managing users. I have a requirement to lock user accounts for 30 mins after 5 unsuccessful attempts. How should I do that using asp.net membership provider on the server side?

Also I want that ‘Passwords should expire after 3 months’, ‘Last 10 used passwords should be remembered’. Is there any way to solve these requirements.

Answer 1

if you are using SqlMembershipProvider then use

maxInvalidPasswordAttempts for attempts

passwordAttemptWindow for locking for specified period

no option for password expiration or password history

but if you are using ActiveDirectoryMembershipProvider then use

maxInvalidPasswordAttempts for attempts

passwordAnswerAttemptLockoutDuration for locking for specified period

and ajust your domain policy for password expiration or password history

full info here

http://msdn.microsoft.com/en-us/library/ff648345.aspx#paght000022_usingthesqlmembershipprovider