Windows 7 - Account Lockout Threshold for Invalid Logon Attempts

   Information

The account lockout threshold security setting determines the number of invalid or failed logon attempts with a incorrect user name and/or password that causes a user account to be locked out. A locked out account cannot be used until it is reset by an administrator or until the account lockout duration for the account has expired or the administrator manually unlocks the locked out user account.

The reset account lockout after security setting determines the number of minutes that must elapse after a invalid logon attempt before the invalid logon attempt counter is reset back to 0 invalid logon attempts.

By default, the account lockout threshold security setting is set to 0 failed logon attempts so that users accounts will never be locked out. This will show you how to set the account lockout threshold for how many failed logon attempts that you want before the user account is locked out.

   Note

Failed password attempts against workstations or member servers that have been locked using either CTRL+ALT+DELETE or password protected screen savers count as failed logon attempts.

   Warning

You will only be able to do this while logged in as an administrator.

1. Open the Local Security Policy editor.

2. In the left pane, expand Account Policies, and click on Acount Lockout Policy. (see screenshot below)

3. In the right pane, double click on Account lockout threshold. (see screenshot above)

4. Type in a number between 0 and 999 for how many invalid logon attempts you want allowed before the user acount is locked out, then click on OK. (see screenshot below)
NOTE: Typing in the number 0 will disable account lockout so that users accounts will never be locked out for invalid logon attempts.

5. Click on OK. (see screenshots below)
NOTE: You will not see this window unless you are changing the number of invalid logon attempts from 0 or to 0 in step 4 above. If you have the account lockout threshold (step 4) set to a

6. When done, close the Local Security Policy editor. (see screenshot below)

1. Open a elevated command prompt.

2. To See the Current "Account Lockout Threshold" Setting

A) In the elevated command prompt, type net accounts and press enter. (see screenshots below)
NOTE: If the account lockout threshold is set to 0 invaild logon attempts, it will show as Never here instead. Anything higher than 0 will show as that number.

3. In the command prompt, type the command below and press Enter.
NOTE: Substitute (0-999) for a number between 0 and 999 invalid logon attempts you want allowed before the user acount is locked out. Typing in the number 0 will disable account lockout so that users accounts will never be locked out for invalid logon attempts.

net accounts /lockoutthreshold:(0-999)

For example, for 5 invalid logon attempts, I would type in this command below and press enter.

net accounts /lockoutthreshold:5

4. Close the elevated command prompt.