4.4 Ensure account lockout is set to 15 minutes

Information

An account is automatically locked after the maximum number of failed consecutive login attempts is reached. The account should be automatically unlocked after 15 minutes, otherwise administrators will need to manually unlock accounts on request by authorized users.

Rationale:

This setting reduces the inconvenience for benign users and the overhead on administrators, while also severely slowing down any brute force password guessing attacks.

Solution

To set the account lockout to 15 minutes, perform the following:

From the vSphere Web Client, select the host.

Click 'Configure' -> 'Settings' -> 'System' -> 'Advanced System Settings'.

Enter 'Security.AccountUnlockTime' in the filter.

Click 'Edit'.

Set the value for this parameter to 900.

Alternately, use the following PowerCLI command:

Get-VMHost | Get-AdvancedSetting -Name Security.AccountUnlockTime | Set-AdvancedSetting -Value 900

See Also

https://workbench.cisecurity.org/benchmarks/8020