# Block user after three invalid login attemps

**URL:** <https://forum.inductiveautomation.com/t/block-user-after-three-invalid-login-attemps/14531>\
**Category:** Ignition\
**Created:** [June 15, 2017, 4:35pm UTC](https://forum.inductiveautomation.com/t/block-user-after-three-invalid-login-attemps/14531 "2017-06-15T16:35:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jose.granero](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jose.granero/32/11190_2.png) [@jose.granero](https://forum.inductiveautomation.com/u/jose.granero)\
**Post date:** [June 15, 2017, 4:35pm UTC](https://forum.inductiveautomation.com/t/block-user-after-three-invalid-login-attemps/14531/1 "2017-06-15T16:35:46Z")

</div>

I’m currently working on a project where one of the requirements is blocking a user after three invalid login attemps. What is the best way to implement this feature?.

On the other hand, how can I force users to change the password the first time they log in?

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [June 15, 2017, 6:10pm UTC](https://forum.inductiveautomation.com/t/block-user-after-three-invalid-login-attemps/14531/2 "2017-06-15T18:10:26Z")

</div>

For the first:  
If it’s just end users that you’re worried about, I would build a ‘fake’ login screen for the project. That is, the Ignition project would automatically log in some ‘guest’ user or something similar, and have a simple window with a login/password and a submit button. Then you could use the [system.security.switchUser](https://docs.inductiveautomation.com/display/DOC79/system.security.switchUser) function to check whether it’s a valid user. It would be pretty easy to add some scripting to that login window to ‘count’ the failed login attempts and then perform whatever other action you want.

For the second:  
I would recommend a DB-driven user source. You could set it up in automatic mode to get the tables that you need for a basic structure, then change to manual mode and add a ‘temporary’ column to the authentication table. Thus, your validation (probably on the same pseudo-login screen) could check the value of that ‘temporary’ column, and immediately prompt the user for a new password upon logging in.

---

<div class="post-metadata">

**Author:** ![jose.granero](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jose.granero/32/11190_2.png) [@jose.granero](https://forum.inductiveautomation.com/u/jose.granero)\
**Post date:** [June 16, 2017, 1:11pm UTC](https://forum.inductiveautomation.com/t/block-user-after-three-invalid-login-attemps/14531/3 "2017-06-16T13:11:20Z")

</div>

Thank for your quick answer Paul,

What about implementing Active Directory with the same requirements?, what issues could arise?