Asp.net Membership - Accounts getting locked out

Question

We're using the standard ASP.net membership features that come with asp.net.

Certain accounts in our membership database have a "Locked Out" flag set to true - when/how does this happen?

Answer 1

These 4 guys did a great job of explaining in depth the asp.net membership controls

 <system.web>
... authentication & authorization settings ...

<membership defaultProvider="CustomizedProvider">
  <providers>
     <add name="CustomizedProvider"
          type="System.Web.Security.SqlMembershipProvider"  
          connectionStringName="MyDB"
          applicationName="MyProject"
          minRequiredPasswordLength="5"
          minRequiredNonalphanumericCharacters="0" />
  </providers>
</membership>

basically add your provider and then set the setting the way you'd like them

Answer 2

After a configurable number of failed logins (maxInvalidPasswordAttempts, default = 5) within a configurable length of time (passwordAttemptWindow, default = 10 minutes), the account will be locked out.

see here for membership related configuration properties

Answer 3

When someone try to login 5 times (or whatever "maxInvalidPasswordAttempts" is set to) with the wrong password the account gets locked out ...

to avoid this in the future change the attribute maxInvalidPasswordAttempts in the web.config

example :

<membership defaultProvider="SqlProvider" userIsOnlineTimeWindow="15">
<providers>
  <clear />
  <add 
    name="SqlProvider" 
    ....
    maxInvalidPasswordAttempts="the new value here "
  />
</providers>