In my test environment, I have a test user that keeps going inactive. I activate him (Henry Helper) attempt to log on, mistype the password (not on purpose, but rather because I'm absent minded ) and it says the account is inactive. I go into the security tool, and sure enough the account is inactive. I'd expect a message indicating the password is incorrect or the user name and password don't match and be allowed to try again. There must be some setting I'm not understanding.

There is no message and the message does not change.  The reason for this is basically more security.  By giving too informed a message in this scenario, especially when tight security is needed, it just gives one more leg-up to the person trying to get in illegally.  You can adjust the time span and/or the invalid login attempts in the global preferences if this problem persists in your environment, but as of now we have no plans of changing the message.

Not really concerned with the message, just that the user is marked inactive with a single failed login attempt. What did I setup to make this happen? There must be some way to allow a user to attempt more than a single login attempt?

It is in the global preferences.  Open up the SecurityDialog and go to the global preferences.  It is under Login Attempts.

So, if they fail more than this number, there account becomes inactive? Is this until an admin activates them or just for a while?

Yes, this is in the documentation.  An admin has to turn it back on.

Documentation Articles

Role-Based Security -> Security Maintenance -> Global Preferences -> Global Preference Properties

and

Role-Based Security -> Security within the Application -> Logon -> Failed Logins

OK, this time when I read these, I understand them Thanks!

Sure