Skip to content

Account lockout policy: GUI (Group Policy console)

Read the three lockout values in the Group Policy Management console. See the Account lockout policy overview for what the values mean and what to send us.

Read the settings in gpmc.msc

  1. Open Group Policy Management (gpmc.msc).
  2. Expand Forest → Domains → your domain, right-click the Default Domain Policy, and choose Edit.
  3. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies → Account Lockout Policy.
  4. Read the three settings: Account lockout threshold, Reset account lockout counter after (the observation window), and Account lockout duration.

Lockout settings are not under \"Password Policy\"

The sibling Password Policy node holds complexity, length, and age rules. The three lockout values you're sending us are one node down, under Account Lockout Policy.

Fine-grained policies are not shown here

The Group Policy console shows only the default domain policy. A fine-grained password policy (PSO) that overrides it for specific accounts lives in the Active Directory Administrative Center, not here. If in-scope accounts might be governed by a PSO, use the Get-ADUserResultantPasswordPolicy command on the CLI (PowerShell) page to read the effective values.