Skip to content

Lockout Policy

Even a strong password falls to unlimited guessing. Lockout policy freezes an account after a number of failed attempts, which turns a password-guessing attack from minutes into years.

Where it is

secpol.msc → Account Policies → Account Lockout Policy. (Domain: same path in the Default Domain Policy.)

The settings

Setting What it does Reasonable range Use
Account lockout threshold (1.2.2) Failed logins before the account locks. 0 means never. 5 to 50 (STIG: 3 or less) 5, or 3 for a STIG baseline
Account lockout duration (1.2.1) Minutes the account stays locked 5 to 30 30
Reset account lockout counter after (1.2.4) Minutes of no failures before the count resets to zero 5 to 30 30
Allow Administrator account lockout (1.2.3) Whether the built-in Administrator can be locked out too Enabled Enabled

Why not a threshold of 3? Real users mistype. A threshold that locks people out on a typo trains them to call the help desk, and trains the help desk to unlock without asking questions.

The reset window can't be longer than the lockout duration. Keeping them equal avoids the error.

Step by step

  1. secpol.msc → Account Policies → Account Lockout Policy.
  2. Double-click Account lockout threshold, type 5, OK. Windows offers to set the other two to 10 minutes; click OK to accept for now.
  3. Double-click Account lockout duration, set 30.
  4. Double-click Reset account lockout counter after, set 30.
  5. Double-click Allow Administrator account lockout, set Enabled.

The duration and reset settings are greyed out until the threshold is above zero. That's why the threshold goes first.

Verify

net accounts

Lockout threshold:                                    5
Lockout duration (minutes):                           30
Lockout observation window (minutes):                 30

Test it

  1. Create a test user: net user testlock Passw0rd!Test /add
  2. Log out. Try to log in as testlock with the wrong password six times.
  3. Log back in as yourself. net user testlock shows Account locked out Yes.
  4. Unlock in lusrmgr.msc → Properties, then net user testlock /delete.

Next

Verify Both Policies