Account Lockout Management with Bmc Truesight It Data Analytics

Enterprises globally are investing meticulously in data integrity and security tools from business and regulation perspective. The importance of these tools has gained more advantage after the recent movement of government vigilance regarding information and communication flow in most of the countries. Implementing strong password policies is therefore imperative and at the same time critical for business. However, strong password policies at times act like a double-edged sword bringing in a huge inflow of account lockout incidents for the IT Service Desk.

Addressing account lockout Issues for any IT service desk is a cumbersome task given the number of such tickets toping the incidents logs every day along with never ending calls to the desk for password resets. Scenarios like these resonate with the majority of IT Service Desks across the enterprises. The amount being spent on administrative staff to handle account lockout issues too is not a nominal cost that the organizations have been incurring for the longest time. Seemingly for service desks, there is no way out of this.

A countless number of account lockout issues not only impacts the efficiency of service desks, but spreads over various facets involving productivity loss, frustrated users, and huge administrative burden. However, automation can truly redefine the resolution process of account lockout scenarios while offering an enhanced user experience to both the service desks and the users.

This white paper highlights, how automation of account lockout resolution can save hours of productivity for the users and the service desk teams at smaller and larger organizations. BMC IT has effectively saved productivity time of its service desk by using BMC TrueSight IT Data Analytics. The number of hours invested in resolving such cases was brought down drastically from an average of 3-4 hours each ticket to a mere 10 minutes.

Current Scenario

Account lockout is a process of automatically disabling a user account based on specified criteria like too many failed login attempts. Failed login situations could arise due to various reasons, for example, a user returning from a long holiday and after somehow pushing himself back to work he tries to remember his password, he makes several guesses but ends up exceeding a given number of attempts. In another situation, the user can mistype password five times simply because he has not had his coffee yet. This makes account locked out and typically follows with a phone call to the helpdesk. The entire process consumes crucial business resources in terms of the time spent by the service desk on resolving this issue as well as the loss of employee/user productivity. Similarly, password expiry poses another challenge as once a password is changed, it gets updated only in Active Directory and nowhere else. Thus, leaving a user locked out from his/her account.

Even the most efficient organizations spend a significant amount of time and cost on account lockout management. On average, IT departments spend almost one-third of their total productive time on the resolution of user lockouts and password issues. The time that IT staff spends on these problems is only the top of the iceberg, as soon as we consider the lost user productivity and service downtime, the impressions are likely to rise by manifold.

Typical Account Lockout Resolution Workflow Use Case

A general task flow, when a user gets locked out generally looks like as mentioned below:

• “Account Locked Out’ error reflects on the user’s screen, following which the user contacts the service desk.
• The service desk engineer verifies the user and unlocks the account.
• If the problem persists, the user calls service desk once again and asks for further investigation.
• Service desk engineer performs a routine lookup of possible sources of account references.
• After checking all account references, service desk engineer unlocks the account.
• If the problem persists anyway, the service desk engineer would reach to DC Admin to perform the further investigation. It is difficult for even a Level 3 engineer to search all DC servers, number of log files, and events to identify the source details of the lockout for a specific user.