Account lockout policy: CLI (PowerShell)¶
Read the three lockout values with the Active Directory PowerShell module. See the Account lockout policy overview for what the values mean and what to send us.
Read the default domain policy¶
Run this on a domain-joined machine with the Active Directory module (any host with RSAT, or a domain controller):
Get-ADDefaultDomainPasswordPolicy |
Format-List LockoutThreshold, LockoutObservationWindow, LockoutDuration
LockoutThresholdis the number of attempts (0means never lock out).LockoutObservationWindowis the observation window.LockoutDurationis the lockout duration (00:00:00means locked until an admin manually unlocks).
The full policy, including the password rules, is just
Get-ADDefaultDomainPasswordPolicy with no filter.
Check for a fine-grained override¶
If specific in-scope accounts might be governed by a fine-grained password policy (a PSO), the default-domain values above may not apply to them. Get the policy that actually applies to a given account:
Get-ADUserResultantPasswordPolicy -Identity <sAMAccountName>
Send us the effective values for the accounts in scope. If you're not sure whether a PSO is in play, send both the default and the resultant values and note it.
No on-premises Active Directory?
If your environment is cloud-only (Microsoft Entra ID / Azure AD with no on-prem AD), lockout is handled by smart lockout instead. Let your engagement lead know and we'll confirm the details with you.