Account Lockout - Reset account lockout counter after

Question

Hi Expert,
Would you know any disadvantages if we set the Account Lockout Policy - Reset account lockout counter after to longer value e.g. 24 hours or maximum of 99,999 minutes.?
Regards,
Jhun

Answer 1

Hi Jhun,
I agree with Jack that when we configure account lockout policy, both security and user experience should be considered and balanced.
If we set the value of Reset account lockout counter after for too long,
Users may make excessive Help Desk calls, in the meanwhile, if this value is set too short, the attacker would have more chances to crack the system.
Therefore, administrators should take cautious when configuring policies, protecting organization’s network, and avoiding that un-related person having physical access to machines within organization.
More information for you:
Reset account lockout counter after
http://technet.microsoft.com/en-us/library/hh994568.aspx
Best Practice Active Directory Design for Managing Windows Networks
http://technet.microsoft.com/en-us/library/bb727085.aspx
Best Regards,
Amy Wang