What to do if your MHC Account is "locked"

Issue

You are trying to log into a system using your MHC Account and you get the error message "Account locked."

Why does this happen?

If your MHC Account has 25 invalid log in attempts within 15 minutes, it will be temporarily locked.

The invalid attempts do not need to all be from attempting to log into the same system with your MHC Account. For example, a lockout could be caused by 15 invalid attempts from a device attempting to connect to eduroam, 5 invalid attempts to log into Moodle, and 5 invalid attempts to log into Workday so long as those attempts all occur within 15 minutes of each other. 

The account will unlock after 15 minutes have passed without hitting the 25 invalid log in attempt threshold. The LITS Technology Help Desk is unable to reduce that wait time. 

Potential causes and how to respond

Devices attempting to connect to eduroam with an invalid saved password

After you change your password, your devices will keep trying to connect to eduroam if it's in range, which can contribute to an account lockout.

HOW TO RESOLVE: If you reset your MHC Account password, remember to always update the saved password for eduroam on your phone and other devices.

Other invalid cached/saved credentials

Devices and applications will sometimes hold onto passwords for you so you don't need to enter them as often. However, when you change your MHC Account password, the saved ones are no longer accurate.

HOW TO RESOLVE:

• If you use a password manager or browser features to save/auto-fill your passwords, it is important to keep your saved MHC Account password up to date. 
• You may also need to update your MHC Account password in Windows Credential Manager or in macOS Keychain Access
  • For example, to resolve the "Hold for Authentication" error when attempting to print at MHC using Mobility Print. 

Brute force attacks

A brute force attack is a hacking method that uses trial and error to crack passwords, login credentials, and encryption keys. Our account lockout settings are designed to prevent your MHC Account from being compromised in this way. 

HOW TO RESPOND: If you think that your MHC Account is locked due to a brute force attack, please create a ticket.