# Smart lockout threshold isn't greater than 10
When the smart lockout threshold is set to more than 10, threat actors can exploit the configuration to conduct reconnaissance, identify valid user…
Source: https://maester.dev/docs/tests/ZTA.21850
:::note[Maester checks this too]
[CIS.M365.5.2.3.8](/docs/tests/CIS.M365.5.2.3.8) (Ensure that Account 'Lockout threshold' is '10' or less), [EIDSCA.PR06](/docs/tests/EIDSCA.PR06) (Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold.) check the same setting. Running both reports it twice.
:::
## Overview
When the smart lockout threshold is set to more than 10, threat actors can exploit the configuration to conduct reconnaissance, identify valid user accounts without triggering lockout protections, and establish initial access without detection. Once attackers gain initial access, they can move laterally through the environment by using the compromised account to access resources and escalate privileges.
Smart lockout helps lock out bad actors who try to guess your users' passwords or use brute force methods to get in. Smart lockout recognizes sign-ins that come from valid users and treats them differently than ones of attackers and other unknown sources. A threshold of more than 10 provides insufficient protection against automated password spray attacks, making it easier for threat actors to compromise accounts while evading detection mechanisms.
## Remediation
- [Set Microsoft Entra smart lockout threshold to 10 or less](https://learn.microsoft.com/entra/identity/authentication/howto-password-smart-lockout?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Identity |
| Category | Access control |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Password protection |
| Area | Authentication |
| ATT&CK | [T1110.001](/docs/tests?mitre=T1110.001) Password Guessing, [T1110.003](/docs/tests?mitre=T1110.003) Password Spraying |
| Licence | P1 |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.