Manipulating Kerberos failure codes during APM policy

You could probably get away with just reading the session.ad.last.errmsg value.

 

 

Both expired and locked accounts send the message "User account is locked"

 

Bad password sends the message "Invalid user credentials"

 

 

Setting the "Max Logon Attempts Allowed" in the AD auth agent to something lower will let it escape the agent sooner so that you can follow branch rules. For example:

 

 

expr { [mcget {session.ad.last.errmsg}] contains "User account is locked" }

 

expr { [mcget {session.ad.last.errmsg}] contains "Invalid user credentials" }