Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 64

Account disabled
The user sees an error message stating that his account has been disabled and that
he should contact the system administrator.
Account locked out
The user sees an error message stating that his account has been locked and that
he should contact the system administrator.
Password has to be changed
The user can log in but receives a warning that the password needs to be changed
soon. This warning is sent three days before that password expires. After expiration,
the user cannot login again.
Invalid workstation
When a user is just allowed to log in from specific workstations and the current
SUSE Linux Enterprise Desktop machine is not in that list, a message appears that
this user cannot log in from this workstation.
Invalid logon hours
When a user is only allowed to log in during working hours and tries to log in
outside working hours, a message shows that login is not possible at this point in
time.
Account expired
An administrator can set an expiration time for a specific user account. If that user
tries to log in after that time has passed, the user gets a message that the account
has expired and cannot be used to log in.
During a successful authentication, pam_winbind acquires a ticket granting ticket
(TGT) from the Kerberos server of Active Directory and stores it in the user's credential
cache. It also takes care of renewing the TGT in the background, not requiring any user
interaction.
52 Security Guide