AD-PWDPOL-07: Account lockout threshold should be retrievable


ID	`AD-PWDPOL-07`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Password policy
Security area	Authentication
Resource type	Tenant
MITRE ATT&CK	T1110
Reads from	On-premises Active Directory

What this checks and how to fix it

Account lockout threshold is one of the most important defenses against brute-force attacks:

Prevents automated attacks: Limits the number of passwords an attacker can try
Detects attacks: Lockout events can trigger alerts for security monitoring
Protects weak passwords: Even users with weaker passwords get some protection

A threshold of 5 or fewer failed attempts provides strong protection while allowing for the occasional user mistake. Setting it to 0 (never lock out) removes this critical protection entirely.

Control Type

Preventive

Security Recommendation

Configure the account lockout threshold to 5 or fewer failed attempts. Never disable account lockout (threshold = 0) as this removes critical protection against brute-force attacks.

To configure this setting:

Open Group Policy Management
Navigate to the Default Domain Policy
Edit: Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Account Lockout Policy
Set Account lockout threshold to 5 or fewer invalid logon attempts

Note: When you set the lockout threshold, Windows will suggest appropriate values for:

Account lockout duration (recommend: 30 minutes)
Reset account lockout counter after (recommend: 30 minutes)

How the Test Works

Current lockout threshold (number of failed attempts)
Recommended maximum (5 attempts)
Critical warning if lockout is disabled

Test-MtAdAccountLockoutDuration - Checks how long accounts remain locked

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).