Skip to content

Account lockout policy

Before an internal penetration test begins, we need your Active Directory account lockout policy. Some of the techniques we use (for example, testing weak or reused passwords) make authentication attempts against real accounts. If we don't know your lockout thresholds, we risk locking out legitimate users and disrupting your business. With the policy in hand, we pace testing to stay under it.

What we need from you

Three values from the domain(s) in scope:

Value What it means Example
Lockout threshold Failed sign-in attempts allowed before an account locks 5 attempts
Observation window How long failed attempts are counted before the counter resets 30 minutes
Lockout duration How long a locked account stays locked 10 minutes, or 0 / indefinite (until an admin unlocks)

A threshold of 0 means accounts never lock out

If your lockout threshold is 0, accounts are never locked no matter how many attempts fail. That's a valid answer: just tell us it's 0 and we don't need the other two values.

Fine-grained policies can override the default

If in-scope accounts are governed by a fine-grained password policy (a PSO, set in the Active Directory Administrative Center or via Get-ADFineGrainedPasswordPolicy), the default-domain values may not apply to them. To get the policy that actually applies to a specific account, use the Get-ADUserResultantPasswordPolicy command on the CLI (PowerShell) page. Send us the effective values for the accounts in scope, and if you're not sure whether a PSO is in play, send both and note it.

No on-premises Active Directory?

If your environment is cloud-only (Microsoft Entra ID / Azure AD with no on-prem AD), lockout is handled by smart lockout instead. Let your engagement lead know and we'll confirm the details with you.

Choose how to gather it

  • CLI (PowerShell)

    One Get-ADDefaultDomainPasswordPolicy command reads all three values (plus the fine-grained PSO lookup). The fastest path on any host with the AD module.

  • GUI (Group Policy console)

    Read the three settings in the Group Policy Management console (gpmc.msc) under Account Lockout Policy.

  • AI assistant (LLM)

    A copy-paste, read-only prompt that has your AI assistant gather the three values for you.

What to send us

Reply to your engagement lead with the three values (threshold, observation window, duration) for each in-scope domain. That's everything we need on the lockout side to schedule testing safely.