Reset account lockout counter after

[Guest]

Our default domain account lockout policy is set like this:

Lockout Duration = 0 (I want Aministrator manually unlock)
Lockout Threshold = 4
Reset Counter After = ???

Microsoft say about Reset account lockout counter after:
If an account lockout threshold is defined, this reset time must be less
than or equal to the Account lockout duration. So how can I set Reset Counter
After <= Lockout Duration???

Thanks,

Nhut

 

[Steven L Umbach]

I believe you can set it to whatever you want if the lockout duration is 0.
FYI MS recommends that lockout threshold be no less than ten bad attempts.
Account lockout is a dual edge sword that can result in DOS attacks against
your users. Unless required by external policy, many places are not using
account lockout if they are enforcing strong passwords or better yet pass
phrases. --- Steve

 

[Guest]

Thanks,

I believe you can set it to whatever you want if the lockout duration is 0.
FYI MS recommends that lockout threshold be no less than ten bad attempts.
Account lockout is a dual edge sword that can result in DOS attacks against
your users. Unless required by external policy, many places are not using
account lockout if they are enforcing strong passwords or better yet pass
phrases. --- Steve