Windows Account lockout Policy


Reset account lockout counter after = How long (in minutes) it takes after a failed logon attempt before the counter tracking failed logons is reset to zero (range is 1 to 99,999 minutes).
A few special cases are:

Account lockout duration

 I am trying to understand the difference between
Reset account lockout counter after  AND Account lockout duration


Thanks
jskfanAsked:
Who is Participating?
 
Mike KlineConnect With a Mentor Commented:
So lets say you have passwords set to lock after 5 bad attempts.

I put in 3 bad passwords and get it on number 4.   Right now my account lockout counter is set to 3.   The Reset account lockout after setting sets how long until that counter is set back to 0

account lockout duration sets the number of minutes the account is locked out before becoming automatically unlocked

More on the settings here


http://technet.microsoft.com/en-us/library/cc784599(WS.10).aspx

http://technet.microsoft.com/en-us/library/cc758659(WS.10).aspx

THanks

Mike

0
 
jskfanAuthor Commented:
in  your example you are saying the Lock out kicks in after 5 bad attempts.
you typed 3 wrong passwords then you typed the right password at the 4th attempt. at this stage the counter is set to 0.

This shoudld be the default, and I don't see that it will make sense if it was set up otherwise.


0
 
Mike KlineConnect With a Mentor Commented:
no at that point the counter is still at 3; it will go back to 0 after the time you set in the policy.

Thanks

Mike
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
jskfanAuthor Commented:
in our case is 15 minutes.

I don't understand the purpose of this setting <<Reset account lockout counter after>>
If the setting didn't exist at all what would as a security breach.??
0
 
Mike KlineConnect With a Mentor Commented:
0
 
jskfanAuthor Commented:
I understand. it stores the number of your failed login attempts even after you succeded to login [as long as you didn't pass the threshold ]. and the number will be reset to 0 when the time of [Reset account lockout counter after] has expired.

It is just another Headache for the Administrators ..)

0
 
Mike KlineConnect With a Mentor Commented:
I'd personally like to see self service PW reset features...without add-on products.
0
 
jskfanAuthor Commented:
Thanks for your help
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.