Account lockout policy: AI assistant (LLM)

Paste this into your AI assistant on a domain-joined admin machine to gather the three lockout values to send your Sophos engagement lead. See the Account lockout policy overview for what the values mean and what to send us.

Data-gathering prompt

You are helping me collect my Active Directory account lockout policy to send to
the Sophos team before a penetration test. This is a READ-ONLY task: only run
commands that READ policy. Never change, create, enable, or remove any GPO, PSO,
account, or setting. If a command needs rights I do not have, stop and tell me.

STEPS:
1. On a domain-joined machine with the Active Directory PowerShell module (RSAT or
   a domain controller), run:
   Get-ADDefaultDomainPasswordPolicy | Format-List LockoutThreshold, LockoutObservationWindow, LockoutDuration
   Report LockoutThreshold (0 means accounts never lock out, and if it is 0 the
   other two do not matter), LockoutObservationWindow (the reset window), and
   LockoutDuration (00:00:00 means locked until an admin manually unlocks).
2. If specific in-scope accounts might be governed by a fine-grained password
   policy (PSO), also run, for one such account:
   Get-ADUserResultantPasswordPolicy -Identity <sAMAccountName>
   and report its effective lockout values. If unsure whether a PSO applies,
   gather both and note it.
3. If the environment is cloud-only (Entra ID / Azure AD, no on-prem AD), say so:
   lockout is handled by smart lockout and I should tell my engagement lead.

Then give me the three values (threshold, observation window, duration) for each
in-scope domain so I can send them to my engagement lead. Do not change anything.