I have a customer community user who was allowed 14 incorrect password attempts before being 'Password Lockout', although the org's and profile's 'Password Policies' should only allow 5 incorrect password attempts.

I tried testing with another customer community user, it locked me after 5. So, it worked as expected. I compared the 2 users, they are setup in the same way.

Here is the login history of the affected user: enter image description here

Just curious if anyone knows any rules that allow you to get past the 'incorrect password attempts' limit

  • I note 6 different times on these records. I wonder if that is a clue - we're these duplicate records actual login attempts or some data glitch? How many entries did you get when experimenting with being locked out? Was it 5 or was it 6?
    – Phil W
    Commented Jun 15, 2022 at 6:27
  • @PhilW On other users, it let's me with 5 incorrect password attempts and the 6th comes up as Password Lockout. The excel extract(where the screenshot is from) of login history hides the seconds in time. I checked on user record they are all a few seconds apart, so I doubt it is a data glitch. I did some similar tests, it always locks me out after 5. I wonder if it is something stupid that I am not able to figure out haha. Or maybe it's just a glitch from Salesforce. Commented Jun 15, 2022 at 15:44
  • Did the policy get changed after they did the 13 attempts?
    – Phil W
    Commented Jun 15, 2022 at 17:02
  • @PhilW Negative. I double checked the profile last modified date and I trust my memory on password policies haha. The weird thing is that 14 is not even an option to be kept in Incorrect Password Attempts. The options are 3, 5, 10 and No Limit Commented Jun 15, 2022 at 17:29


You must log in to answer this question.