Solved Account Lockout Policy Clarification

[goldenlight1814]

Hello Guys,

Can somebody interpret this one for me.

Account Lockout Duration : 0 minutes
Account threshold : 15
Reset Account Lockout after: 10 minutes.


Thanks in advance.

This is driving me crazy!

 

[Brink]

Hello Goldenlight, and welcome to Seven Forums.

Account Lockout Duration : 0 minutes = The account lockout duration security setting determines the number of minutes a locked out account remains locked out, after reaching the account lockout threshold of invalid logon attempts with a incorrect user name and/or password, before automatically becoming unlocked. When this is set to 0, then a locked out user account will be locked out until an administrator manually unlocks that locked out user account.

See: http://www.sevenforums.com/tutorials/72258-account-lockout-duration-locked-out-user-accounts.html

Account threshold : 15 minutes = The account lockout threshold security setting determines the number of invalid or failed logon attempts with a incorrect user name and/or password that causes a user account to be locked out in Windows. A locked out account cannot be used until it is reset by an administrator or until the account lockout duration for the account has expired or the administrator manually unlocks the locked out user account.

See: http://www.sevenforums.com/tutorials/72240-account-lockout-threshold-invalid-logon-attempts.html

Reset Account Lockout after: 10 minutes = The reset account lockout after security setting determines the number of minutes that must elapse after a invalid logon attempt before the invalid logon attempt counter is reset back to 0 invalid logon attempts. If the account lockout threshold of invalid logon attempts is reached before the counter resets, then the user account will be locked out until either the account lockout duration has expired or the administrator manually unlocks the locked out user account.

See: http://www.sevenforums.com/tutorials/72271-account-lockout-reset-invalid-logon-counter.html

Hope this helps,
Shawn

 

[goldenlight1814]

Actually, I finally figured it out.

Thanks for the definitions Shawn, but the problem is the Account Lockout Duration MUST BE EQUAL OR GREATER than the Reset Account Lockout After. In my example, is it not. But based on a very old discussion I read, if the Account Lockout Duration is set to 0, then the Reset Account Lockout After value does not matter at all.

So hopefully this one helps out someone else in the future.

 

[Brink]