When an ActiveSync-enabled mobile device (typically iOS in our environment) retains stale credentials after a password change, it creates a perfect storm for account lockouts. Our infrastructure - Exchange 2007, TMG 2010, and AD 2008 R2 - follows security best practices by enforcing lockout policies, but we need smarter handling for EAS scenarios.

The problematic sequence looks like this:

1. User changes password (either voluntarily or due to expiration)
2. Mobile device continues authenticating with cached credentials
3. TMG forwards failed attempts to Exchange
4. AD increments badPwdCount until lockout threshold

Here are several approaches we've tested with varying success:

Option 1: Extended Lockout Threshold for EAS Users

Create a custom fine-grained password policy for EAS users:

# PowerShell implementation
New-ADFineGrainedPasswordPolicy -Name "EASPasswordPolicy" 
    -Precedence 100 
    -LockoutDuration "00:30:00" 
    -LockoutObservationWindow "01:00:00" 
    -LockoutThreshold 15 
    -ComplexityEnabled $true 
    -MinPasswordLength 8

Option 2: TMG Pre-Authentication Filter

We developed a custom TMG script to identify EAS traffic patterns:

' VBScript for TMG
Function OnPreAuthenticate(oRequest, oResponse)
    If InStr(oRequest.Headers("User-Agent"), "Apple-iPhone") > 0 Then
        ' Apply different authentication handling
        oResponse.Action = 1 ' Skip normal auth
    End If
End Function

Option 3: AD Event-Based Password Sync

This PowerShell script triggers on password changes and pushes updates:

# PowerShell event handler
Register-ObjectEvent -InputObject (Get-WinEvent -LogName "Security" -FilterXPath 'Event[System[EventID=4723 or EventID=4724]]') 
    -EventName "EventRecordWritten" 
    -Action {
        $targetUser = $Event.SourceEventArgs.EventRecord.Properties[0].Value
        $mobileDevices = Get-ActiveSyncDevice -Mailbox $targetUser
        foreach ($device in $mobileDevices) {
            Update-ActiveSyncDevicePassword -Identity $device.Identity
        }
    }

Each approach has trade-offs:

• Option 1 reduces security slightly but is easiest to implement
• Option 2 requires TMG expertise but maintains security
• Option 3 needs Exchange 2010+ for full functionality

We recommend implementing these verification checks:

# Lockout monitoring script
Get-EventLog -LogName Security -InstanceId 4740 -After (Get-Date).AddHours(-1) |
    Where-Object { $_.ReplacementStrings[0] -match "EAS_" } |
    Export-Csv -Path "C:\EAS_Lockouts.csv" -NoTypeInformation

In hybrid mobile environments with Exchange 2007 and Active Directory 2008 R2, we're seeing a persistent pattern where iOS devices configured with EAS (Exchange ActiveSync) create authentication storms when password changes occur. The core symptom manifests as immediate account lockouts despite successful password changes - all because cached credentials on mobile devices keep hammering authentication endpoints.

Standard approaches like adjusting lockout thresholds or shortening lockout durations merely treat symptoms. The root issue lies in the authentication workflow between four critical components:

// Typical authentication flow causing the issue
1. iOS Device (Old Credentials) → TMG 2010 → Exchange 2007 → AD
2. AD Lockout Policy Triggers (Default: 5 failed attempts)
3. Legitimate Authentication Blocked

For organizations stuck with legacy Exchange 2007, consider implementing this PowerShell monitoring solution that temporarily disables EAS when password changes are detected:

# Exchange 2007 EAS Lockout Prevention Script
$passwordChangeEvents = Get-EventLog -LogName "Security" -InstanceId 4723,4724 -After (Get-Date).AddHours(-1)
$affectedUsers = $passwordChangeEvents | ForEach-Object {
    $_.ReplacementStrings[0]
} | Select-Object -Unique

foreach ($user in $affectedUsers) {
    $mailbox = Get-CASMailbox -Identity $user
    if ($mailbox.ActiveSyncEnabled) {
        Set-CASMailbox -Identity $user -ActiveSyncEnabled $false
        Start-Sleep -Seconds 300 # Allow credential propagation
        Set-CASMailbox -Identity $user -ActiveSyncEnabled $true
        Write-EventLog -LogName "Application" -Source "EAS Lockout Prevention" -EntryType Information -EventId 1001 -Message "Toggled EAS for $user"
    }
}

Adjust these critical settings in your TMG server's EAS publishing rule:

• Enable "Basic Authentication over SSL" only
• Set client IP-based throttling to 1 request/10 seconds
• Configure HTTP compression to prefer efficient sync patterns

For environments dominated by Apple devices, deploy a Mobile Device Management (MDM) configuration profile with these key payloads:

<dict>
    <key>PayloadContent</key>
    <dict>
        <key>ActiveSync</key>
        <dict>
            <key>DisableOnPasswordChange</key>
            <true/>
        </dict>
    </dict>
    <key>PayloadType</key>
    <string>com.apple.eas</string>
</dict>

For organizations planning upgrades, consider these architectural changes:

1. Migrate to Exchange 2016+ which implements Modern Authentication
2. Implement Azure AD Conditional Access policies
3. Deploy Intune for proper MDM-based credential management

Remember that complete resolution may require accepting some temporary disconnects during password changes until you can modernize your infrastructure.