LDAP account locking with Windows (smbldap)

Question

We're running directory server 7 in our area and it's all set up and
working. We're using the smbldap-tools in conjunction to have the
directory server allow domain logins.
The main issue is that we want to enforce account lockouts after 5
failed attempts. When using the built-in password policy in the
directory server to do this, and a user locks their account, they can no
longer log into any of the linux systems (what we want). However, with
windows, a user can still log in with their current password, if they
type a bad password, they get an error saying there's a problem with
their account....so the locking doesn't work.
My theory is just that the LDAP server is preventing windows from seeing
some of the attributes once the account is locked...probably preventing
info from being written to the samba bad password count.
Do you know if there's a way to modify the LDAP server configuration
such that when an account is locked out, to modify OTHER attributes than
the defaults? So, if the directory server enables the lockout, it
modifies not only the pwdaccountlockedtime field, but also, say,
sambaAccountFlags?
Thanks for any tips.

Answer 1

We're running Windows XP systems. Unfortunately we're not running AD, but rather a Samba server, which is storing its information in the Sun Directory Server. I'm not sure if the Identity Synchronization will work with Samba or not. I can also take a look at this windows bug and see if maybe just changing the timeout on the old passwords. If that prevents people from logging in due to an account locking, good enough for me. I think the biggest concern is that we prevent users from accessing their accounts in the event they get locked.
Is what I'm trying to do possible with an ACI perhaps? I'm not familiar enough with the ACIs to know. So, basically IF the pwdaccountlockedtime flag OR the smbacctflag looks a certain way, prevent users from accessing any information from the LDAP server.