We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords.
One way to remedy an account lockout issue is to issue and deploy certificates to our ActiveSync users. I believe this will give us stronger security with Mutual Auth TLS.
Before we implement this, is this a valid solution to the account lockout problem? (Will certificates properly prevent premature account lockouts?)
Do the devices (Windows Phone, Blackberry, iPhone, etc) all use a CRL or OCSP as expected or are there issues I should avoid?
Are there any best practices I should adopt?