APM Policy workflow problem

try this: create a macro with the Logon Page+AD_Query+iRule-Agent, loop it the number of time you want the user to be asked for valid credentials until the Logon_deny. Then in the AD agent set the value "Max logon attemps allowed" to 1