How to customize message on ADFS 3.0 sign-in page for an account lock?

Question

I am using ADFS3.0. Suppose I enter incorrect credentials into ADFS sign-in page it returns error message "The user name or password is incorrect".

If due to some reason I try to log-in to ADFS 3.0 with a locked out account still it returns same message which is I think is not correct.

At this point I want to show a custom message say "Account has been locked-out" in place of "The user name or password is incorrect".

Could anybody help me on it ?

Answer 1

You can customize those messages. (You can explain that the account could be blocked and to try later) / contact IT for assistance, etc.

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn280950(v=ws.11)#custom-error-messages

Answer 2

The reason it returns the same message is because of security.

Different messages could give hints as to how best to mount an attack.

To know that an account is locked out, ADFS would have to do an LDAP query to AD and that type of functionality is not available.