I was wondering if there is any limit on number of Global properties which is being called using API based on computer ID. Lately we are seeing our API operator account(Its AD account) getting Locked out which was not the case earlier as we have added multiple more global properties.
Based on my experience working with the BigFix REST API for several years, I have not seen any documented or practical hard limit on the number of Global Properties retrieved via API. There is a request/session timeout behavior, but that typically results in request failures rather than causing account lockouts (whether the operator account is local or AD-based).
In our environment we use an AD service account extensively for numerous API integrations, including custom reporting and data lake ingestion. These integrations generate a large number of API queries, and we have not observed account lockouts occurring as a result of API activity itself.
I would recommend coordinating with your AD/Identity team to review the lockout source in the domain controller logs, as they should be able to identify the system or process generating the failed authentication attempts.
Additionally, it may be worth checking the system from which the API calls are initiated. In some cases, stored credentials in Windows Credential Manager (or other cached authentication mechanisms) can still reference an old password after a password change or reset, which may lead to repeated authentication failures and eventual account lockout.
Note: Please also ensure that the entire system is reviewed for any stored scripts, batch jobs, or legacy processes (sometime even FillDB is configured to start using same AD account) that might still be using the API account. Sometimes older automation or scheduled tasks may have been forgotten or are no longer actively monitored. If such processes are still running with outdated credentials, they can repeatedly attempt authentication and eventually lead to account lockouts.
4 Likes