Account lockout policy

[NagarajMadyasth]

I need to read the individual value before setting new values for bellow attributes
Account lockout duration/threshold/reset account lockout counter
Please let us know how to achive the same.
net accounts /lockoutthreshold:X
net accounts /lockoutwindow:X
net accounts /lockoutduration:X

 

[Ztruker]

Just type in net accounts from a Elevated Command Prompt.

C:\WINDOWS\system32>net accounts
Force user logoff how long after time expires?:       Never
Minimum password age (days):                          0
Maximum password age (days):                          42
Minimum password length:                              0
Length of password history maintained:                None
Lockout threshold:                                    Never
Lockout duration (minutes):                           30
Lockout observation window (minutes):                 30
Computer role:                                        WORKSTATION
The command completed successfully.

 

[NagarajMadyasth]

Just type in net accounts from a Elevated Command Prompt.

C:\WINDOWS\system32>net accounts
Force user logoff how long after time expires?:       Never
Minimum password age (days):                          0
Maximum password age (days):                          42
Minimum password length:                              0
Length of password history maintained:                None
Lockout threshold:                                    Never
Lockout duration (minutes):                           30
Lockout observation window (minutes):                 30
Computer role:                                        WORKSTATION
The command completed successfully.

****************
Thanks for your replay...
Above context i need to read indiviual value by filtering the attribue using "find" command.
Do we have any direct command to read individual attribute ?

 

[GokAy]

Try:

net accounts |findstr /c:"what_to_search_for" /i

Example:

net accounts |findstr /c:"Force" /i
Force user logoff how long after time expires?:       Never

Or to output to a file

net accounts |findstr /c:"Computer" /i>>%userprofile%\desktop\output.txt

 

[Ztruker]

This works to get the 3 Lockout values:

C:\WINDOWS\system32>net accounts |findstr /c:"Lockout" /i
Lockout threshold:                                    Never
Lockout duration (minutes):                           30
Lockout observation window (minutes):                 30

If you redirect the output to a file you can then use a FOR loop to read each line and do stuff with it.

 

[Pyprohly]

[...] Do we have any direct command to read individual attribute ?

There is no direct command to read these settings. The ideal way would be to read the registry items for them, but unfortunately these settings are not actually stored in registry keys.

You're going to have to retrieve these settings using pure Batch.

@echo off
goto :main

:trim_leading_spaces VariableName
setlocal
	call set "_=%%%~1%%"
	set _=%_:"=%
	:trim_leading_spaces__while
	if "%_:~0,1%"==" " ( set "_=%_:~1%"& goto :trim_leading_spaces__while)
endlocal & set "%~1=%_%"
goto :eof

:main
for /f "tokens=1,2 delims=:" %%I in ('net accounts ^| find "Lockout"') do (
	echo.%%I | find "threshold" >NUL && set T=%%J
	echo.%%I | find "duration" >NUL && set D=%%J
	echo.%%I | find "observation" >NUL && set O=%%J
)

call :trim_leading_spaces T
call :trim_leading_spaces D
call :trim_leading_spaces O

echo Threshold: %T%
echo Duration: %D%
echo Observation: %O%

Output (on my machine):

Threshold: Never
Duration: 30
Observation: 30