Skip to main content

How do I set user account lock settings?

When a user logs into Blackboard LMS, a session is created. This session is what allows the user to continue to access the application uninterrupted.

Account locking helps protect accounts from unauthorized access. You can choose the number of login attempts and period of time allowed for those attempts. You can also choose the period of time an account remains locked.


Configure account locking

From the administration panel, under Security, select Account Lock Settings.

  1. Enable Account Locking – Choose whether to lock accounts after failed logins.

  2. Account Lock Settings:

    1. Maximum Login Attempts – Enter the number of failed tries allowed before lockout.

    2. Login Period – Enter the number of seconds in which a user can submit multiple login attempts before the account is locked.

    3. Account Lock Period – Enter the number of minutes the account stays locked; entering 0 makes it permanently locked until an admin manually unlocks it.

    4. Unlock upon password reset – When enabled, users can self-unlock via password reset instead of waiting out the lock period.

  3. Active Session Termination:

    1. Forced Expiry – When enabled, users will automatically be logged out of the system after the maximum number of hours. This feature is enabled by default for Federal Risk and Authorization Management Program (FedRAMP) institutions.

    2. Maximum Session Age – Enter the maximum amount of time a user session can be active.

  4. Inactive Session Timeout – Enter the maximum amount of time a user session can be inactive before being automatically logged out (must be 15–480 minutes).

  5. Mobile App Token Timeout:

    1. Maximum Token Lifetime – Mobile sessions are controlled via an authentication token. This allows the app to automatically renew a session without re-authentication, as long as the token hasn't expired. Enter the maximum length of time of a mobile app user's session before it is auto renewed.

    2. Use same value as Inactive Session Timeout – For security certifications, select Use same value as Inactive Session Timeout to expire sessions in the same timeframe, independently of the type of device users use to login.

  6. Concurrent Session Control: Enter The number of active sessions a user may have at one time across all authentication types, including mobile apps.

For more information, visit Account Lock.

Session Management Considerations

For more information about security concerns for session control, see Session Management.

Did this answer your question?

Related Articles