On 12/2/21 09:34, Ulrich Windl wrote: The LDAP client has to send the appropriate request control and handle the response control values correctly. Most LDAP clients do not support this. For various reasons grace logins are IMO a miserable concept and the situation you've described is just one of the symptoms that it's seriously broken. Grace logins might work in a world of workstation logins (tightly controlled end-points). But it does not work for LDAP-based logins where you have arbitrary systems accessed via arbitrary clients. 1. Set grace logins to zero. 2. Instead implement decent mechanism to warn the user that his/her password expires soon, e.g. by sending e-mail or other messages. 3. If the user misses warning (2.) then have a sufficiently secure password reset procedure in place (which you need anyway). Ciao, Michael.