Detections
Analytics

1.2.2 Ensure 'Account lockout threshold' is set to '5 or fewer invalid logon attempt(s), but not 0'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting determines the number of failed logon attempts before the account is locked.

The recommended state for this setting is: 5 or fewer invalid logon attempt(s), but not 0.

Note: A value of 0 does not conform to the benchmark as it disables account lockout threshold.

Note #2: Password Policy settings (section 1.1) and Account Lockout Policy settings (section 1.2) must be applied via the Default Domain Policy GPO in order to be globally in effect on domain user accounts as their default behavior. If these settings are configured in another GPO, they will only affect local user accounts on the computers that receive the GPO. However, custom exceptions to the default password policy and account lockout policy rules for specific domain users and/or groups can be defined using Password Settings Objects (PSOs), which are completely separate from Group Policy and most easily configured using Active Directory Administrative Center.

Setting an account lockout threshold reduces the likelihood that an online password brute force attack will be successful. Setting the account lockout threshold too low introduces risk of increased accidental lockouts and/or a threat actor intentionally locking out accounts.

Solution

To establish the recommended configuration via GP, set the following UI path to 5 or fewer invalid login attempt(s), but not 0 :

Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Account Lockout Policy\Account lockout threshold

Impact:

If this policy setting is enabled, a locked-out account will not be usable until it is reset by an administrator or until the account lockout duration expires. This setting may generate additional help desk calls.

If you enforce this setting a threat actor could cause a denial-of-service condition by deliberately generating failed logons for multiple users, therefore you should also configure the Account Lockout Duration to a relatively low value.

If the Account Lockout Threshold is set to 0, there is a possibility that a threat actor's attempt to discover passwords with a brute force password attack might go undetected if a robust audit mechanism is not in place.

See Also

https://workbench.cisecurity.org/benchmarks/25733

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7, 800-53|AC-19, CSCv7|16.11

Plugin: Windows

Control ID: ab721911f4236be60e24340834e799679557dbf34b67c39ca4e1ae7a2a958440