I'm having trouble getting the membership provider to lock out accounts when they exceed the max attempts. I have set the maxInvalidPasswrodAttempts to 3, and the passwordAttemptWindow to 10, and yet accounts will not be locked out if I exceed the thresholds. I read in the docs that requiredQuestionAndAnswer must be set to true for the lockout mechanism to work. I did that, but still no luck. Below is my config file. I am using the ValidateUser call to authenticate users. I assume that method will set the lockout flag as needed. Anybody have any ideas?
Thanks!
<add name="AspNetSqlMembershipProvider"
type="System.Web.Security.SqlMembershipProvider"
connectionStringName="ApplicationServices"
minRequiredPasswordLength="8"
enablePasswordRetrieval="true"
passwordFormat="Encrypted"
enablePasswordReset="true"
requiresQuestionAndAnswer="true"
...
Go to the complete details ...