Find AD Account Lockout Source

Account lockouts are problematic for two reasons:

• They happen silently, so detection is difficult. As an admin, you might not know that a lockout has occurred until a user calls.
• They happen due to a bevy of different reasons, from a program using cached credentials to a user logging on to multiple devices, so troubleshooting is hard.

To detect and troubleshoot lockouts using native Microsoft tools, such as LockoutStatus tool or PowerShell, you have to wade through several interfaces, which requires expertise and time. With ADAudit Plus' user account lockout tool, you can detect and troubleshoot lockouts, check lockout status, spot lockout anomalies, trigger responses, and do much more in just a few clicks. Additionally, you can archive Windows event logs indefinitely and review logs at your convenience, helping you meet audit and compliance requirements with ease.

Although it is not possible to prevent all lockouts, implementing these three best practices can reduce their number significantly.

1. Enable the “Account lockout duration” policy:

The account lockout duration depends on organization-specific information such as the user count or industry type. Setting the duration to zero will keep the account secure by locking the account until an admin unlocks it. However, this also results in excessive requests to the help desk.

The recommended duration is between 30 and 60 minutes

2. Leverage the “Account lockout threshold” policy:

If the account lockout threshold is set too low, accidental lockouts will be frequent. This could also make the account vulnerable to denial-of-service attacks since it's easier for the attacker to intentionally enter the wrong passwords to lock the account. On the other hand, if the threshold is set too high, the probability of a successful brute-force attack increases as the attacker has more opportunities to try and guess the credentials.

The recommended threshold is 15 to 50.

3. Configure the “Reset account lockout counter after” policy:

While calculating the “reset account lockout counter after” value, organizations need to keep in mind the type and level of security threats they face, balanced with the cost of help desk calls. This value should be less than or equal to the account lockout duration.

The recommended setting is anything less than 30 minutes.