Change Account Lockout Threshold in Windows

Objectives of Changing the Account Lockout Threshold:

1. Prevent Brute-Force Attacks: Limits attempts to guess passwords and gain unauthorized access.
2. Strengthen Security: Reduces the risk of unauthorized access to sensitive accounts.
3. Balance Security and Usability: Prevents frequent lockouts for legitimate users by setting an appropriate threshold.
4. Enable Monitoring: Tracks failed login attempts, aiding in detecting potential security breaches.
5. Mitigate Insider Threats: Limits repeated malicious login attempts within an organization.

Step 1: Open the Local Security Policy Editor

• Press Win + S to open the search bar.
• Type Local Security Policy or ‘secpol.msc’ and select the app from the search results.

  

Step 2: Navigate to Account Lockout Policy

• In the Local Security Policy window, expand Account Policies in the left-hand panel.
• Click on Account Lockout Policy to display related settings on the right-hand side.

  

Step 3: Modify the Account Lockout Threshold

• Double-click on Account lockout threshold from the list of policies.
• A dialog box will appear. Enter the desired number of invalid login attempts (e.g., 5 before the account gets locked out.
• Click OK to save the changes.

  

Step 4: Adjust Related Settings Automatically

• Once you set the threshold, Windows will prompt you to configure two additional settings automatically:
• Account lockout duration: Defines how long the account remains locked.
• Reset account lockout counter after: Determines how long before the failed login attempts counter resets.
• Adjust these settings if needed, or leave them as default, and click OK.

  

Step 5: Verify the New Settings

• Return to the Account Lockout Policy section in the Local Security Policy window.
• Confirm that your changes to the Account lockout threshold and related settings are applied.

  

Step 6: Close the Local Security Policy Editor

• Once all changes are confirmed, close the Local Security Policy window.