N-2 password history
Password history check (N-2):
Before a Windows Server 2003 operating system increments
badPwdCount
, it checks the invalid password against the password history. If the password is the same as one of the last two entries that are in the password history,
badPwdCount
is not incremented for both NTLM and the Kerberos protocol. This change to domain controllers should reduce the number of lockouts that occur because of user error.