AD DS - Account Lockout Policies

Account lockout policies

Set your account lockout policies based on organizational needs

Account lockout policies protect again password guessing

Account lockout policies enable you to define whether accounts should be locked if there are too many logon tries with invalid passwords. Most organizations implement account lockout policies to prevent attackers from using password-guessing techniques to gain access to a network. Using this approach provides a level of security. However, it also exposes your organization to a denial of service attack because an attacker can run scripts to guess user passwords and lock out user accounts. If you decide not to implement account lockout policies, it's important that you monitor failed account logon tries in real time to prevent an attacker from taking advantage of this configuration. There are three corresponding Group Policy settings.

Account lockout policies work together

Setting	Description	Values
Account lockout duration	Defines the number of minutes that a locked account remains locked. After the specified number of minutes, the account automatically unlocks.	Normal setting:  30 minutes Administrator must unlock the account: 0 minutes
Account lockout threshold	Determines the number of failed logon tries that are allowed before a user account is locked out. Set this value high enough to allow for mistyped passwords, but low enough to make sure the failure of brute force attempts to guess a password.	Account is never locked out: 0 attempts Typical: 3 – 5 attempts
Reset account lockout counter after	How many minutes must elapse after a failed logon attempt before the bad logon counter is reset to zero. This setting applies when a user has typed in a password incorrectly, but the user has not exceeded the account lockout threshold.	Recommended value: 30 minutes