Windows security account lockout

Please rate your experience Yes No. Any additional feedback? Submit and view feedback for This product This page. View all page feedback. In this article. Configure security policy settings. Skip to main content. This browser is no longer supported. Download Microsoft Edge More info. Contents Exit focus mode. Is this page helpful? Please rate your experience Yes No. Any additional feedback? The Windows and Windows Server operating systems can track logon attempts, and you can configure the operating system to disable the account for a preset period of time after a specified number of failed attempts.

Account lockout policy settings control the threshold for this response and what action to take after the threshold is reached. A denial-of-service DoS condition can be created if an attacker abuses the Account lockout threshold policy setting and repeatedly attempts to log on with a specific account. After you configure the Account lockout threshold policy setting, the account will be locked out after the specified number of failed attempts.

If you configure the Account lockout duration policy setting to 0, the account remains locked until you unlock it manually. Configure the Account lockout duration policy setting to an appropriate value for your environment. To specify that the account will remain locked until you manually unlock it, configure the value to 0. When the Account lockout duration policy setting is configured to a nonzero value, automated attempts to guess account passwords are delayed for this interval before resuming attempts against a specific account.

Using this setting in combination with the Account lockout threshold policy setting makes automated password guessing attempts more difficult. Configuring the Account lockout duration policy setting to 0 so that accounts cannot be automatically unlocked can increase the number of requests that your organization's Help Desk receives to unlock accounts that were locked by mistake. Skip to main content.