Secedit Example: Windows Account Lockout: 15/10/10
Log In or Register to download the BES file, and more.

1 Votes

Description

Configure Windows Account Lockout Policy (for Workstation or Member Servers, not Domain Controllers).

15 bad attempts in 10 minutes triggers 10 minute lockout.


Property Details

ID27000
StatusBeta - Preliminary testing ready for more
TitleSecedit Example: Windows Account Lockout: 15/10/10
DomainBESC
SourceInternal
Source Release Date4/10/2023 12:00:00 AM
Keywordswindows, security policy, account, account lockout
Added by on 4/10/2023 4:29:51 PM
Last Modified by on 4/10/2023 4:29:51 PM
Counters 246 Views / 1 Download
User Rating 1 star 2 star 3 star 4 star 5 star * Average over 0 ratings. ** Log In or Register to add your rating.

Relevance

isWindows (Relevance 1172)
Used in 1157 fixlets and 540 analyses   * Results in a true/false
Show indented relevance
windows of operating system
Used in 33 fixlets and 17 analyses   * Results in a true/false
Show indented relevance
if exists property "in proxy agent context" then not in proxy agent context else true
Used in 1 fixlet   * Results in a true/false
Show indented relevance
/* no domain controllers */ product type of operating system = nt workstation product type or product type of operating system = nt server product type
Used in 1 fixlet   * Results in a true/false
Show indented relevance
(account lockout duration of it / minute != 10 or account lockout observation window of it /minute != 10 or account lockout threshold of it != 15) of security database

Actions

Action 1 (default)

Action Link Click here to deploy this action.
Script Type BigFix Action Script
action uses wow64 redirection {not x64 of operating system}
delete __createfile
createfile until BIGFIX_EOF_MARKER
[Unicode]
Unicode=yes
[System Access]
LockoutBadCount = 15
ResetLockoutCount = 10
LockoutDuration = 10
[Version]
signature="$CHICAGO$"
Revision=1
BIGFIX_EOF_MARKER

delete tempdb.sdb
delete tempcfg.inf
move __createfile tempcfg.inf
waithidden secedit.exe /configure /cfg tempcfg.inf /db tempdb.sdb
continue if {exit code of action = 0}
Success Criteria

This action will be considered successful when the applicability relevance evaluates to false.


Sharing

Social Media:
Share this page on Yammer

Comments

Log In or Register to leave comments!