TNBlogsFS/prod.evol.blogs.technet.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/00/84/58/metablogapi/Screenshot-209_0D6710B8.png' alt='Windows Active Directory Account Lockout Tool' title='Windows Active Directory Account Lockout Tool' />Implementing and Troubleshooting Account Lockout. Account lockout is a feature of password security in Windows 2. The purpose behind account lockout is to prevent attackers from brute force attempts to guess a users passwordtoo many bad guess and youre locked out. To configure account lockout in a domain environment you typically use the Default Domain Policy, a Group Policy Object GPO linked to the domain. The relevant Group Policy settings are found under Computer Configuration. Windows Settings. Security Settings. Account Policies. Account Lockout Policy. The default settings for account lockout are shown in Figure 1 Figure 1 Default account lockout policy for a domain. Avant Garde Gothic Alternate. The three policy settings are Account lockout duration How long in minutes a locked out account remains locked out range is 1 to 9. Account lockout threshold How many failed logons it will take until the account becomes locked out range is 1 to 9. Reset account lockout counter after How long in minutes it takes after a failed logon attempt before the counter tracking failed logons is reset to zero range is 1 to 9. A few special cases are Account lockout duration 0 means once locked out the account stays locked out until an administrator unlocks it. Account lockout threshold 0 means the account will never be locked out no matter how many failed logons occur. As you can see from Figure 1 above, the default account lockout policy is that accounts are never locked out. ITKE/uploads/blogs.dir/46/files/2009/02/eventcombmt.png' alt='Windows Active Directory Account Lockout Tool' title='Windows Active Directory Account Lockout Tool' />Active Directory received three major enhancements with the release of Windows Server 2016. This article will review Privileged Access Management, Azure AD Join. Microsoft Windows Server 2008 R2 introduced a new approach for managing Active Directory. Any R2 domain controller now runs an Active Directory web service for remote. Is that a good or bad idea Pros and Cons of Account Lockout. On the face of it, account lockout seems like a good thing to implement as it makes it difficult for attackers to launch brute force attacks against passwords for user accounts. For example, if Account lockout threshold 5 then after five guesses of the users password the users account could be automatically locked out for Account lockout duration 3. Then after 3. 0 minutes elapses the attacker gets another 5 attempts at cracking the password, after which he is locked out again. Obviously it will take some time this way to crack a password. On the other hand, if Account lockout threshold 5 and the user hasnt had her coffee yet, she might easily mistype her password 5 times in a row and lock herself out. Then comes the proverbial call to Help Desk saying I cant log on to my computer and precious business resources are consumed, both in terms of the time spent resolving the problem and the loss of productivity for the user. Theres more to it though. What if the attacker doesnt care if he guesses the users password Perhaps all hes interested in is preventing the user from logging on to the network. In this case the attacker can simply enter any random string for the users password 5 times in a row and suddenly the user is unable to log on to her computer. Again an annoying call to Help Desk and lost productivity on the users part. This demonstrates how an attacker can utilize account lockout to create a denial of service Do. S condition. While these examples seem somewhat contrived since they assume an attacker has physical access to the network, it turns out account lockout is much more than just typing wrong passwords into the Log On to Windows dialog box. Other ways accounts can get locked out include Applications using cached credentials that are stale. Stale service account passwords cached by the Service Control Manager SCM. Stale logon credentials cached by Stored User Names and Passwords in Control Panel. Scheduled tasks and persistent drive mappings that have stale credentials. Disconnected Terminal Service sessions that use stale credentials. Failure of Active Directory replication between domain controllers. Users logging into two or more computers at once and changing their password on one of them. Any one of the above situations can trigger an account lockout condition, and the results can include applications behaving unpredictably and services inexplicably failing. What should you do Even Microsoft seems to be of two minds concerning whether to implement account lockout. On the one hand, on page 3 of their white paper called Account Lockout Best Practices, they recommend the following Microsoft recommends that you use the account lockout feature to help deter malicious users and some types of automated attacks from discovering user passwords. They then go on to recommend the following account lockout policies for low, medium and high security environments Low Security. Account lockout duration Not Defined. Account lockout threshold 0 no lockoutReset account lockout counter after Not Defined. Medium Security. Account lockout duration 3. Account lockout threshold 1. Reset account lockout counter after 3. High Security. Account lockout duration 0 an administrator must unlock the accountAccount lockout threshold 1. Reset account lockout counter after 3. On the other hand, Ben Smith and Brian Komar on page 4. Microsoft Windows Security Resource Kit suggest something different Although account lockout settings are common, often they are the cause of numerous support calls to the help desk. If passwords are appropriate in length and complexity, this setting provides little additional security. Troubleshooting Account Lockout. Assuming youve come down on the side of implementing an account lockout policy, are there any tools that can help you troubleshoot problems arising from locked out accounts The answer is yes Microsoft provides a free set of tools called Account Lockout and Management Tools which you can download as the self extracting file ALTools. Microsoft Download Center. The remainder of this article examines several of these tools more detail on them can be found in the Account Lockout Best Practices white paper mentioned previously. Installing ALTools. After youve downloaded ALTools. Download Center, double click on the file to extract the tools to a directory of your choosing. Then install the tools as needed on domain controllers, member servers, or workstations as described under each tool discussed below. Acct. Info. dll. This DLL adds a new tab called Additional Account Info to user account properties sheets in the Active Directory Users and Computers ADUC. Copy the file to the System. ADUC typically an administrator workstation with adminpak. DLL. Now open ADUC and view the properties of a locked out user like Bob Smith in Figure 2 below Figure 2 Acct. Info. dll adds the Additional Account Info tab to the properties sheet for a user account. Theres lots of information here, but in particular line four indicates the date and time when Bobs account became locked and when it will automatically unlock. Clicking the Domain PW Info button displays the password policy for the domain Figure 3 Result of clicking the Domain PW Info button. Clicking the Set PW On Site DC button lets you reset the password for the user and unlock the account see Figure 3. This is useful because if you want to reset a users password you should do it using a domain controller in the AD site where the users computer resides, otherwise replication latency may cause a delay before the user can log on again. This is a better approach to resetting an account by right clicking on it and selecting Reset Password. Figure 4 Resetting a users password on a DC in a remote site. ALockout. dll. This tool creates a log file that can help you diagnose the cause of account lockout problems. Extract the files from ALockout. Windows 2. 00. 0 or Alockout.