Windows 10: "Allow Administrator account lockout" policy does not work (and its documentation is also...

The cumulative update KB5018410 introduced a new group policy Allow Administrator account lockout to Windows 10, accessible via Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policies in the Group Policy Editor. Note the uppercase „Administrator“. The Explain tab also reads: „This security setting determines whether the builtin Administrator account is subject to account lockout policy.“ Clearly, this policy is not meant to apply to any member of the local Administrators group (those were already subject to account lockout before), but to the builtin account named Administrator only.

I made these two observations:

• KB5020282 is ambiguous at best, as it uses plural terms such as „local administrators“ instead of „the local Administrator account“ or „the builtin Administrator“.

• The policy does not even work! After setting it to Enabled and rebooting, I entered wrong passwords for the Administrator account several times. While Windows delayed further logon attempts for a couple of seconds, the account was not locked. I had set the lockout duration to 10 minutes, but was able to try more passwords (and eventually logon successfully) within mere seconds. Furthermore, the logon screen had never shown the expected message: „The referenced account is currently locked out and may not be logged on to.“

The best part: The Windows Event Log states that the Administrator account was indeed locked out:

PS> Get-WinEvent -LogName Security | where Message -Match 'A user account was locked out' | fl TimeCreated : 2022-10-13 04:05:00 ProviderName : Microsoft-Windows-Security-Auditing Id : 4740 Message : A user account was locked out. Account That Was Locked Out: Security ID: S-1-5-21-1684788044-3587618769-3163299276-500 Account Name: Administrator

There seems to be something horribly wrong with this new policy…

submitted by /u/cschneegans
[link] [comments]

:)

 

Account Lockout Policy is not working


Hello guys,

I have Windows 10 Enterprise build 10240 on my Dell Tablet (32 bit) and Oracle VM (32 bit). On both system, I tried to setup Account Lockout Policy in Local Security Policy. I have Account Lockout Threshold = 5, Lockout Duration and Reset Lockout Account Counter = 30 min. However, after locking my account or signing off, my account is not locked after 5 and more failed logon attempts. This feature worked correct on my Windows 8.1 system with the same account lockout settings.
Does anyone experienced the same behavior? Any explanation or fix?

Thank you very much,

 

the account lockout policy threshold property grayed out

Hi YaredBekele,

Welcome to Microsoft Community and thank you for sharing your concern with us today.

I understand that the account lockout policy threshold property grayed out. I am glad to offer you help on this issue.

That’s the domain controller, right? So it’s not in the group policy. You could modify in the Control panel > Administrative Tools > Domain

controller security policy.

If your computer is not domain controller, you could remove all the group policy. Click here to get the steps.

There is a link for the account lockout policy threshold. If you want know more, please click here.

I hope the information provided is useful for you. If you have any additional questions, please do not hesitate to reach out to our support.



Best Regard,

Kevin | Microsoft Community Support Specialist

-----------------------------------------------------

*Beware of scammers posting fake support numbers here."

*Kindly Mark and Vote this reply if it helps, as it will be beneficial to more community members reading here.

 

Is there an equivalent to the 'Account lockout threshold' security policy setting for Windows 10 Home users?

My understanding is that Windows 10 Home users don't have access to the Account lockout threshold security policy setting (and by extension the Account lockout duration policy setting) because Local Security Policy isn't available in Windows 10 Home. Is
there an equivalent setting available that will allow me to set a threshold for login attempts and lockout duration on my laptop?