Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If a user types in the wrong password 3 times and manages to lock themselves out of their account, how long by default does that user need to wait before they can try again?

Can an admin change the waiting period to be shorter?

This is for Windows Server 2008 R2 - Active Directory 6.1

share|improve this question
up vote 3 down vote accepted

30 minutes is the default time before AD unlocks an account.

To change this, do the following:

Open Active Directory Users and Computers.

  • In the console tree, right-click the domain or organizational unit that you want to set Group Policy for.
  • Click Properties, and then click the Group Policy tab.
  • Click an entry in Group Policy Object Links to select an existing Group Policy object (GPO), and then click Edit. You can also click New to create a new GPO, and then click Edit.
  • In the console tree, click Account Lockout Policy (console tree location is: Group Policy Object [computer name] Policy/Computer Configuration/Windows Settings/Security Settings/Account Policies/Account Lockout Policy).
  • In the details pane, right-click the policy setting that you want, and then click Properties.
  • If you are defining this policy setting for the first time, select the Define this policy setting check box.
  • Select the options that you want, and then click OK.
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .