KB-2407 User account locks after half of the configured failed login attempts due to duplicate counting
Symptoms
User accounts are locked after fewer failed login attempts than configured in the Admin Console.
The default user account lockout threshold is configured to 6 failed login attempts in the Admin Console.
- User account is locked after only 3 failed login attempts.
- The 'Locked' flag appears on the user's profile after 3 failed attempts instead of the configured 6 attempts.
- Issue is reproducible consistently across multiple environments.
Cause
This issue has been reported to the Appian Product Team. The reference number for this issue is AP-40258.
Failed login attempts are occasionally registered and counted twice in the system, causing the account to lock after half the configured threshold. For example, if the lockout limit is set to 6 attempts, the account locks after 3 actual failed login attempts because each attempt is counted twice internally.
Action
There is no action currently available for this issue. If you are facing this issue, please open a support case with Appian Support.
Workaround
Double the configured failed login attempt threshold to account for the duplicate counting behavior. For example, if 6 actual failed login attempts should be allowed before lockout, configure the threshold to 12 in the Admin Console.
This ensures users have the intended number of actual login attempts before their account is locked.
Affected Versions
This article applies to all versions of Appian on 25.4 and later.
Last Reviewed: October 2026