Symptom
If the bad password counter is set as 3 on AD, two failed entries will lock the account.
Conditions
Kerberos authentication with a bad password attempt will try twice.
Workaround
Increase the bad password count on AD
Further Problem Description
