Active Directory - Unlock Timer

Question

If a user types in the wrong password 3 times and manages to lock themselves out of their account, how long by default does that user need to wait before they can try again?

Can an admin change the waiting period to be shorter?

This is for Windows Server 2008 R2 - Active Directory 6.1

Solution

30 minutes is the default time before AD unlocks an account.

To change this, do the following:

Open Active Directory Users and Computers.

• In the console tree, right-click the domain or organizational unit that you want to set Group Policy for.
• Click Properties, and then click the Group Policy tab.
• Click an entry in Group Policy Object Links to select an existing Group Policy object (GPO), and then click Edit. You can also click New to create a new GPO, and then click Edit.
• In the console tree, click Account Lockout Policy (console tree location is: Group Policy Object [computer name] Policy/Computer Configuration/Windows Settings/Security Settings/Account Policies/Account Lockout Policy).
• In the details pane, right-click the policy setting that you want, and then click Properties.
• If you are defining this policy setting for the first time, select the Define this policy setting check box.
• Select the options that you want, and then click OK.