Follow up ...
There is also an enrolment setting for versions 3.7,3.6,3.5,and 3.4. Think for those the following is default:
$CFG->enrol_plugins_enabled="manual,guest,self,cohort";
So 'locked out' could be two fold ... auth + enrol method depending.
'spirit of sharing', Ken