Skip to content

Account lockout policy: CLI (PowerShell)

Read the three lockout values with the Active Directory PowerShell module. See the Account lockout policy overview for what the values mean and what to send us.

Read the default domain policy

Run this on a domain-joined machine with the Active Directory module (any host with RSAT, or a domain controller):

Get-ADDefaultDomainPasswordPolicy |
  Format-List LockoutThreshold, LockoutObservationWindow, LockoutDuration
  • LockoutThreshold is the number of attempts (0 means never lock out).
  • LockoutObservationWindow is the observation window.
  • LockoutDuration is the lockout duration (00:00:00 means locked until an admin manually unlocks).

The full policy, including the password rules, is just Get-ADDefaultDomainPasswordPolicy with no filter.

Check for a fine-grained override

If specific in-scope accounts might be governed by a fine-grained password policy (a PSO), the default-domain values above may not apply to them. Get the policy that actually applies to a given account:

Get-ADUserResultantPasswordPolicy -Identity <sAMAccountName>

Send us the effective values for the accounts in scope. If you're not sure whether a PSO is in play, send both the default and the resultant values and note it.

No on-premises Active Directory?

If your environment is cloud-only (Microsoft Entra ID / Azure AD with no on-prem AD), lockout is handled by smart lockout instead. Let your engagement lead know and we'll confirm the details with you.