Account Lockout does not work on workstations.

[Lee Yew]

I have 1 domain server and several workstations, running on Windows 2000
server and pros. The workstations normally log on to the local computer
instead of the domain computer( but it is joined to the domain controller
for some reasons).

Recently i've set the account lockout threshold as 3 invalid and logon
attempt , account lockout duration and reset lockout as 15 minutes. i can
see that both the local and effective settings the same now. Now the problem
is, it doesn't apply to the local computer/workstation. I know that it will
run if the workstations logs in to the domain directly. How do i set it
without logging in to the domain?

Tan.

 

[Roger Abell]

To set account policies that will have effect on machine
local accounts, use a GPO that is linked at the OU instead
of the domain level.