ADFS 3.0 Issue - Caching Bad Passwords

Question

We have come across a slightly odd problem with ADFS.
For over a year now we have been running ADFS 2.0 for our Office 365 Enterprise Mail, the solution was set up as default ( with the obvious exception of Certs and passwords it was plain next, next next and take all the defaults ) and this has been perfect
all this time.
We just used the same method for a nice default install of ADFS 3.0 and we have switched one of our smaller domains to use it as a test, however we have come across a very annoying issue.
If a user opens Outlook, they get a password prompt as usual, if they put in the password all is perfectly fine, if however they accidentally typo and put in the wrong password, when the password prompt finally comes up a second time, it dosent seem to care
if they put the right one in, it sends the first password again, and keeps going no matter what you do until the account is locked out, the only way to fix it is to close and reopen outlook.
I'm sure many people will not read or understand this correctly and just say it's a setting or some other issue with Outlook etc. but bear in mind I can even switch this domain back to our ADFS 2.0 setup and do the same test with the same user and the same
machine, and everything works as you'd expect, and typing the correct password the second time leads to authentication. This must therefore be an issue or difference between ADFS 2.0 and 3.0, or perhaps its just a plain old bug, who knows, all I do know is
that it's an issue that causes some very annoyed users, and we cant complete our update to ADFS 3.0 until this is fixed.
I have read a few ADFS 3.0 articles that suggest that using a GMSA account ( the default ) may be to blame so I am investigating using a normal account as the service account, but that does unfortunately seems to entail a reinstall of ADFS to accomplish
so will take a little time to switch.
Any help or ideas would be appreciated.

Answer 1

Hi David,
I just tested this on Outlook 2013, after input a wrong password, the password prompt popped out without any error message, and the wrong password was cached (displayed as ********), if I click on OK, the password prompt will popped
back with wrong password again.
Is this the issue which you were referring to?
If that’s the case, then it is a normal behavior, by design at least. To avoid account lockout, every time the password prompt pops out after a failed logon attempt, we need to clear the password, then input a correct one manually.
Best Regards,
Amy