What is account lockout?
Account lockout defends against online password guessing. The system counts failed sign-in attempts; when the count reaches a threshold, the account refuses further attempts, even with the correct password, until a timer runs out or an administrator unlocks it. Without lockout, an attacker at a sign-in prompt could keep trying passwords with no limit.
The three Windows lockout settings
| Setting | What it controls | Notes |
|---|---|---|
| Account lockout threshold | How many invalid attempts trigger a lockout | 0 means the account never locks |
| Account lockout duration | How many minutes the account stays locked | 0 means it stays locked until an administrator unlocks it |
| Reset account lockout counter after | Minutes without a bad attempt before the failure count returns to zero | Must not exceed the lockout duration |
Where to configure it
- Local Security Policy (
secpol.msc) > Account Policies > Account Lockout Policy, on Windows Pro, Enterprise and Education. - Group Policy under Computer Configuration > Windows Settings > Security Settings > Account Policies. Domain accounts get their lockout policy from a GPO linked at the domain level.
- Command line, any edition:
net accounts /lockoutthreshold:5 /lockoutduration:15 /lockoutwindow:15. Runningnet accountsby itself shows the current policy.
To unlock a local account, open lusrmgr.msc, open the user's Properties and clear Account is locked out. In a domain, use the Account tab in Active Directory Users and Computers or the PowerShell cmdlet Unlock-ADAccount.
Failed-attempt limits on phones and tablets
Mobile devices count failed unlock attempts too. After several wrong entries they impose growing delays before another try is allowed. A stricter option erases the device after a set number of failures; on iPhone and iPad this is the Erase Data setting, which wipes after 10 failed passcode attempts. Organizations usually enforce these limits through mobile device management (MDM). Because auto-erase can also wipe a device for a forgetful owner, it should be paired with backups.
Lockout vs. look-alike account states
- Locked out: temporary, caused by failed attempts.
- Disabled: an administrator turned the account off; it stays off until re-enabled.
- Expired: the account reached its expiration date.
- Logon hours: a valid password is refused outside the permitted times.
- Screen lock: protects a session that is already signed in; it has nothing to do with failed passwords.
Limits and side effects
- Password spraying tries one or two common passwords against many accounts and stays under the threshold on each. Banned-password screening and MFA cover that gap.
- Offline cracking of stolen password hashes never touches the sign-in prompt, so lockout does not apply. Long passwords are the defense there.
- Self-inflicted lockouts: a very low threshold raises help desk calls, and an attacker can lock out real users on purpose by entering wrong passwords.
- Stale saved passwords: after a password change, a phone mail app or mapped drive still using the old password can lock the account again and again.
Account lockout on the CompTIA A+ exam
Account lockout belongs to Core 2 (220-1202) objective 2.7, workstation hardening and account management, and objective 2.8, where failed login attempt restrictions protect phones and tablets. Know the three settings, where they live (secpol.msc, Group Policy, net accounts) and how lockout differs from disabled and expired accounts. If a question asks how to slow down password guessing against an account, think lockout threshold. If a user is locked out every morning right after a password change, look for an old password saved on another device. If a phone wiped itself after repeated wrong passcodes, the erase-after-failed-attempts policy did its job.