Windows Integrated Authentication: How does SPSS Statistics Server handle expired user credentials?

Windows Integrated Authentication in SPSS Statistics Server

SPSS Statistics Server can be configured to use Windows Integrated Authentication, delegating access control to the Windows domain. The server itself does not enforce a least‑privilege model beyond what the domain defines.

When a Windows user’s password expires, the server typically accepts the login attempt, but the underlying Windows authentication process may reject the session or prompt the user to change the password, depending on domain policy and SPSS configuration. No documented SPSS feature automatically revokes or denies access for expired credentials.

Unresolved Decision

It remains unclear whether SPSS Statistics Server should provide its own mechanism to detect and block access for accounts with expired passwords, independent of Windows, to enforce least‑privilege more strictly. Implementing such a mechanism would require integration with Windows authentication events or querying the domain controller before authorizing a session.

Given this uncertainty, the following questions arise:

• Does SPSS Statistics Server currently log authentication attempts for expired credentials, and if so, how are they recorded?
• What are the implications for least‑privilege enforcement if the server relies solely on Windows for credential validation?
• Is there a recommended approach for administrators to ensure users with expired passwords are blocked at the SPSS level rather than at the Windows domain level?