Configure Local Administrators Account lockout

Account lockout helps keep user accounts secure by preventing unauthorized users etc., from guessing the username and password. When your account is locked, you will have to wait for a specified amount of time before being able to log into your account again. Therefore, the account lockout policy “locks” the user’s account after a defined number of failed password attempts. In this article, you will learn how to configure Local Administrators Account lockout. Kindly refer to these related guides: How to Change User Account Type in Windows 10, Is my AD user account or service account password correct? How to run an App as a different User and switch Users in Windows, User account and process management in Linux, and how to find disabled Active Directory User accounts.

In the past, it was recommended to disable the local Administrator account due to several known vulnerabilities such as the built-in administrator account cannot be locked out no matter how many failed login attempts, making it a prime target for brute-force attacks that attempt to guess passwords. This is no longer true as beginning October 11, 2022, or later Windows cumulative updates, a local policy will be available to enable local administrator account lockouts. 

Please here are some related articles: How to deploy MBAM for Bitlocker Administration, How to increase Windows PIN complexity, how to fix The logon attempt failed for the remote desktop connection, how to fix “The following error occurred attempting to rename the computer Account already exists“, and how to Change Account Lockout Threshold for Local Accounts in Windows: The reference account is locked.

Why Enable Local Administrator Account Lockout?

Brute force attacks are one of the prevalent ways Windows devices are attacked today. Previously, Windows devices did not allow local administrators to be locked out. This leads to scenarios where without the proper network segmentation. Or the presence of an intrusion detection service, the local administrator account can be subjected to unlimited brute force attacks to attempt to determine the password.

This can be done using RDP over the network. If the passwords are not long or complex, the time it would take to perform such an attack is becoming trivial with modern CPUs/GPUs. Here are some related guides. What is Pass the Hash Attack and how to mitigate the attack, and Windows 11 Hardware and Software Requirements: How to upgrade to Windows 11. Also, see how to enable or disable Windows Defender Credential Guard.

Enable account lockouts for Administrator accounts

In an effort to prevent further brute force attacks/attempts. Microsoft is implementing account lockouts for Administrator accounts beginning with October 11, 2022. Or later Windows cumulative updates, a local policy will be available to enable local administrator account lockouts. This policy can be found under.

Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policies. 

For existing machines, setting this value to Enabled using a local or domain GPO will enable the lockout for the Administrator accounts. Such environments should also consider setting the other three policies under Account Lockout Policies. Our baseline recommendation is to set them to 10/10/10.

This means an account would be locked out after 10 failed attempts within 10 minutes. And the lockout would last for 10 minutes, after which the account would be unlocked automatically. Kindly refer to this interesting guide: What is Pass the Hash Attack and how to mitigate the attack.

For new devices running Windows 11, v22H2, or any new device that will include October 11, 2022. Windows cumulative updates before the initial setup, these settings will be set by default at system setup. This occurs when the SAM database is first instantiated on a new machine. So, if a new machine was set up and then had the October updates installed later. It will not be secure by default and will require the policy settings above. 

If you do not want these policies to apply to your new computer. You can set the local policy above or create a group policy to apply the Disabled setting for “Allow Administrator account lockout.”

Password Complexity

Securing your environment requires that strong passwords be employed. This helps eliminate the threat of a malicious user guessing a weak password. Whether through manual methods or by using tools, to acquire the credentials of a compromised user account. This is especially true for administrative accounts. When you change a complex password regularly, it reduces the likelihood of a successful password attack.

Password policy settings control the complexity and lifetime of passwords. Password policies affect Windows passwords, not necessarily feature passwords.

Now, password complexity is now enforced on new devices having the local administrator account enabled. The password must have at least three of the four basic character types (lower case, upper case, numbers, and symbols). This will help further protect these accounts from being compromised because of a brute force attack. However, if you want to use a less complex password, you can still set the appropriate password policies in the location below.

Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

I hope you found this blog post helpful on how to configure Local Administrators’ Account lockout. Please let me know in the comment session if you have any questions.