Solved

AD Account Lockout duration

Posted on 2012-03-09
4
1,028 Views
Last Modified: 2012-08-13
Hello, I have a quick question one of you folks may be able to answer.  

I need to find out what the current ISO, etc industry standard AD lockout duration recommendations are.  Ive found that NIST and the NSA recommend 15 minutes and SANS recommends 240 minutes but I would like to have another source (hopefully in black and white terms) so that I can bring that info to my CIO.  

Currently we have it set to 0, this requires me to unlock every locked account manually.
0
Comment
Question by:SSNYT
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 51

Accepted Solution

by:
Keith Alabaster earned 250 total points
ID: 37704217
There is no industry standard on this setting becuase there is no standard security policy that would meet the security requirements of every organisation. In truth, the only likely 'starting standard' in use are the settings Microsoft put out during the initial deployment of AD.

Some installers may change the number of attempts before lockout occurs, some may change the time duration before new attempts can be made etc; the fact is though that 99 times out of 100 an installer - or the admins that take over the installed environment - will change one or more settings based upon their specific security policy needs to something other than the MS defaults. It is almost a ritual.

The reality is that each organisation will set their own standard based upon their specific documented security policy. Without a security policy document, what would be the basis of setting any of the parameters to a particular value?
0
 
LVL 16

Assisted Solution

by:santoshmotwani
santoshmotwani earned 250 total points
ID: 37704249
Its depends on your industry and enviroment . I manage call centre and we have lock out time of 10 mins.
0
 
LVL 1

Author Comment

by:SSNYT
ID: 37709822
Thanks Keith, that was the answer I found as well.
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 37709828
Welcome :)
0

Featured Post

Secure Your WordPress Site: 5 Essential Approaches

WordPress is the web's most popular CMS, but its dominance also makes it a target for attackers. Our eBook will show you how to:

Prevent costly exploits of core and plugin vulnerabilities
Repel automated attacks
Lock down your dashboard, secure your code, and protect your users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you thought ransomware was bad, think again! Doxware has the potential to be even more damaging.
I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question