We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords.

One way to remedy an account lockout issue is to issue and deploy certificates to our ActiveSync users. I believe this will give us stronger security with Mutual Auth TLS.

  • Before we implement this, is this a valid solution to the account lockout problem? (Will certificates properly prevent premature account lockouts?)

  • Do the devices (Windows Phone, Blackberry, iPhone, etc) all use a CRL or OCSP as expected or are there issues I should avoid?

  • Are there any best practices I should adopt?

1 Answer 1


This page seems to indicate that when client certificates are used, then clients are authenticated by the certificate only, with no reference to any password (just like what is done with smart card logon). No password implies no failed password entry, thus no password-related lockout. Of course, as with all things Microsoft, this requires some thorough testing.

Whether devices will properly download CRL or OCSP responses depends on these devices, and personally I doubt they will. Note, though, that the device authenticates the server certificate; validation of the client certificate happens on the server, so that's the server which should download CRL or OCSP responses when client certificates are used. Microsoft's software tends to do revocation checks more or less properly (i.e. they reject the connection when the CRL cannot be obtained).

My cynical part tells me that the best practice with PKI is probably to run away as quickly as possible when X.509 certificates are talked about. It is known that maintaining a PKI is a lot of work. Microsoft's PKI (Active Directory Certificate Services) does a lot of things automatically and works best when all the involved systems are part of the same Domain as the CA.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .