AD-PWDPOL-06 - Account lockout duration should be retrievable

Contributed by Michael Soule with Merill FernandoAll contributors →

Overview

Account lockout duration is a critical control for preventing brute-force attacks while maintaining usability:

• Brute-force protection: Lockouts prevent attackers from trying unlimited password combinations
• Automatic recovery: Users can regain access after the duration expires without administrative intervention
• Balance point: Too short provides little protection; too long impacts productivity

A lockout duration of at least 30 minutes provides adequate protection against automated attacks while minimizing help desk calls. Setting it to 0 (until administrator unlocks) provides maximum security but requires administrative overhead.

Control Type

Preventive

Security Recommendation

Configure the account lockout duration to at least 30 minutes for automatic unlock, or set to 0 for manual unlock only (maximum security).

To configure this setting:

1. Open Group Policy Management
2. Navigate to the Default Domain Policy
3. Edit: Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Account Lockout Policy
4. Set Account lockout duration to 30 minutes or more (or 0 for manual unlock)

How the Test Works

This test retrieves the default domain password policy using Get-ADDefaultDomainPasswordPolicy and extracts the LockoutDuration value. The test reports:

• Current lockout duration in minutes (or "until administrator unlocks" if 0)
• Recommended minimum (30 minutes)
• Whether the configuration meets security best practices

Related Tests

• Test-MtAdAccountLockoutThreshold - Checks the number of failed attempts before lockout

Test Metadata

Field	Value
Test ID	AD-PWDPOL-06
Severity	Info
Suite	Active Directory
Category	AD.PasswordPolicy
PowerShell test	Test-MtAdAccountLockoutDuration
Tags	AD, AD-PWDPOL-06, AD.PasswordPolicy

Source

• Pester test: tests/ad/passwordpolicy/Test-MtAdAccountLockoutDuration.Tests.ps1
• PowerShell source: powershell/public/ad/passwordpolicy/Test-MtAdAccountLockoutDuration.ps1