Account Lockout Policy Settings Threshold Duration and Reset Counter Explained

The threshold counts failed logons. Windows default is 0 — lockout disabled — which is why a home PC never locks anyone out until an admin turns the policy on. Raising it from 0 activates the other two settings.

1. Too low (2–3): a user with Caps Lock on, a sticky key, or a phone retrying an old mail password locks the account before their second coffee. Helpdesk load explodes, and users start writing passwords on sticky notes — the strict policy has reduced real security.
2. Sane range (5–10): far beyond honest typing mistakes, still tiny against an online guessing attack, which needs thousands to millions of attempts against any decent password.
3. Too high (50+): you have given an attacker 50 free guesses per window, forever. At that point the policy is decoration.

Modern reality check: because lockout only throttles online guessing, its job is to make guessing hopeless, not to be the only wall. A 10-attempt threshold plus a long password plus multi-factor authentication beats a 3-attempt threshold plus a weak password every day of the week.

The duration is the penalty box timer. When it expires, the account unlocks itself and the counter resets. Practical thinking:

1. 15–30 minutes is the office sweet spot: long enough to break an automated guessing run into uselessness, short enough that a genuine user waits it out instead of raising a ticket.
2. Duration 0 means "locked until an admin unlocks it". It sounds maximally secure and is sometimes required by compliance checklists — but be honest about the cost: every accidental lockout becomes an admin task, at 2 AM, on holidays, forever. Only choose 0 if a staffed admin desk truly exists.
3. Remember the interaction with services: a phone or mapped drive still holding the old password can burn the threshold again the moment the duration ends — duration buys time to fix the cause, if you use it.

The third value — Reset account lockout counter after — is the observation window: how long failed attempts are remembered. 5 bad attempts inside the window trigger the lock at a threshold of 5; spread them wider than the window and the counter quietly forgives the early ones. Two rules govern it: the reset window can never exceed the lockout duration (Windows will adjust the values together if you try), and in practice most baselines simply set reset equal to duration — 30 and 30, for example — because the pairing is easy to reason about. A short reset window (say 5 minutes) with a threshold of 10 means an attacker can try 9 passwords every 5 minutes indefinitely without ever locking — roughly 2,600 guesses a day. Numbers interact; always judge the three values as one system, never alone.

Two things every admin should know about how thinking has changed. First, Microsoft's own baselines and defaults have moved: very low thresholds are no longer the recommendation, and since the October 2022 cumulative updates, Windows ships with lockout effectively armed for the built-in Administrator — a default of 10 invalid attempts with an accompanying "Allow Administrator account lockout" policy — because internet-exposed machines were being brute-forced through the one account that historically could not lock. Second, the uncomfortable truth about lockout as a weapon: anyone who knows a username can deliberately lock that account, repeatedly, from anywhere the sign-in is reachable. A disgruntled insider or an external attacker can keep your entire office locked out all day with a trivial script. That is why lockout policy is a seatbelt, not the whole car: strong passwords, MFA, and — above all — not exposing sign-in screens (especially RDP) directly to the internet are what actually end brute-force attacks. Set the three numbers sanely, then go fix the exposure.