DEP & AD Lockouts

An interesting little gotcha that I’ve found in my environment when using Active Directory (AD) to authenticate during the Device Enrolment Program (DEP) setup of a new Mac.


When you turn on authentication in conjunction with DEP, it forces new macs to prompt for user credentials before you can proceed to setup a new Mac. I like using auth as it allows me to get user information from AD such as the users name, position, & team at enrolment with JAMF and means I can really customise their Mac setup.


One of the pitfalls of this is that users are forced to enter AD creds at a pre-boot screen which means they don’t have access to a password manager; not a great experience if this password is particularly complex.

Bypassing the issue of having to look this password up on a mobile device, they now need to type this into their Mac. Here’s where the real fun begins.

After two incorrect password attempts, if on the third try they get the password right, they still won’t be able to login. At this point I login to AD and see that their account is locked. “Hmmm” you might say, that’s only two incorrect password attempts, but I’ve set my lock out policy to allow 6 incorrect attempts.


And that’s where the gotcha comes in. From my testing it appears like every incorrect attempt to auth with AD while setting the Mac up is tried an additional 2 times before reporting back as incorrect. This means that two incorrect attempts by a user is seen as 6 by AD.

I’m not exactly sure why this is happening but I’ve modified my lock out policy to allow 10 incorrect attempts in 1 hour. This will allow the user 3 incorrect attempts on their end. Hopefully they get it right on the 4th try.

Related Posts

Automatic Configuration of Zoom Rooms on macOS & iOS

How I Learned to Stop Worrying (about DEP) and Love the Nuke & Pave

Creating APFS Snapshots at the Setup Assistant

Setting a Random Wallpaper at Enrolment

JNUC 2017 Videos

Culture First Onboarding at JNUC 2017


Programming YubiKeys in a VM

Using ElastiCache with Jamf Pro in Clustered Environments

Connecting Gooogle Calendar & Zoom with Zapier