Detections
Analytics

1.2.4 Ensure 'Reset account lockout counter after' is set to '15 or more minute(s)'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting determines the length of time before the Account lockout threshold resets to zero. The default value for this policy setting is Not Defined. If the Account lockout threshold is defined, this reset time must be less than or equal to the value for the Account lockout duration setting.

The recommended state for this setting is: 15 or more minute(s).

Note: Password Policy settings (section 1.1) and Account Lockout Policy settings (section 1.2) must be applied via the Default Domain Policy GPO in order to be globally in effect on domain user accounts as their default behavior. If these settings are configured in another GPO, they will only affect local user accounts on the computers that receive the GPO. However, custom exceptions to the default password policy and account lockout policy rules for specific domain users and/or groups can be defined using Password Settings Objects (PSOs), which are completely separate from Group Policy and most easily configured using Active Directory Administrative Center.

If the account lockout policy is left at its default setting or configured with an excessively long interval, the environment may be vulnerable to denial-of-service (DoS) attacks. A threat actor could repeatedly attempt to login across multiple accounts, triggering lockouts and disrupting access.

Without a defined lockout threshold, administrators would need to manually reset affected accounts. However, by setting a reasonable lockout duration, accounts will automatically unlock after a specified period, reducing administrative overhead and maintaining security.

Solution

To establish the recommended configuration via GP, set the following UI path to 15 or more minute(s) :

Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Account Lockout Policy\Reset account lockout counter after

Impact:

Users can accidentally lock themselves out of their accounts if they mistype their password multiple times.

See Also

https://workbench.cisecurity.org/benchmarks/25733

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7, 800-53|AC-19, CSCv7|16.5

Plugin: Windows

Control ID: 3d84e0bb4309a4799862e05deb144967edc674c738532a7c97758f941c6da33c