18 - How to Configure Account Lockout Policy on Windows Server 2022 (Video Tutorial in Khmer)

Hello my friend! Today I show you step-by-step how to Configure Account Lockout Policy in Windows Server 2022! Account Lockout Policy protects your Active Directory domain from brute-force password guessing attacks by automatically locking out user accounts after a specific number of failed login attempts! Very easy to follow with video tutorial in Khmer! Let's get started!

Step 1: Open Default Domain Policy in Group Policy Management

Account Lockout Policy MUST be configured inside Default Domain Policy (or Fine-Grained Password Policy) to apply to all domain accounts:

1. Open Server Manager > click Tools > select Group Policy Management (gpmc.msc).
2. Expand your Forest > Domains > expand domain name (example: rean.local).
3. Right-click Default Domain Policy > select Edit....

💡 Tip: Always configure Account Lockout Policy inside Default Domain Policy linked at domain root level! Creating a custom GPO for account lockout at OU level will NOT affect domain user accounts!

Step 2: Navigate to Account Lockout Policy Settings

Inside Group Policy Management Editor console:

1. Navigate to: Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies → Account Lockout Policy
2. On right side pane, you will see 3 important security policy items:
   • Account lockout threshold
   • Account lockout duration
   • Reset account lockout counter after

Step 3: Configure Threshold, Duration, and Counter Settings

Now set security values for lockout settings:

1. Double-click Account lockout threshold:
   • Set value to 5 invalid logon attempts (or 3 to 5).
   • Click OK.
2. Windows security popup will suggest default values for duration and reset counter:
   • Account lockout duration: 15 minutes (or 30 minutes).
   • Reset account lockout counter after: 15 minutes.
3. Click OK to accept suggested values.

💡 Tip: Setting Account lockout threshold = 0 means accounts will NEVER lock out! Setting threshold to 5 is ideal balance between security protection and avoiding locking out real users who mistype passwords.

Step 4: Force Group Policy Update on Domain Controller

Apply updated security policy across your domain controllers immediately:

1. Open Command Prompt (cmd) or PowerShell on Domain Controller.
2. Force Group Policy update:

gpupdate /force

💡 Tip: Group Policy automatically replicates to all secondary Domain Controllers within a few minutes!

Step 5: Verify Account Lockout Policy & Test Lockout

Verify active domain lockout settings using command line:

1. Open Command Prompt (cmd) and check active domain policies:

# Display domain password and lockout policy settings
net accounts /domain

Output will show:

Lockout threshold:                 5
Lockout duration (minutes):        15
Lockout observation window (mins): 15

2. Test Lockout: Go to client PC, attempt logging in with valid username (example: sok.dara) and wrong password 5 times in a row!
3. On 6th attempt, Windows will display message: The referenced account is currently locked out and may not be logged on to.

💡 Tip (How to Unlock User Account): If employee account gets locked out, open Active Directory Users and Computers (dsa.msc), double-click user > Account tab > check box [x] Unlock account. This account is currently locked out on this Active Directory Domain Controller. > click Apply!

Watch Video Tutorial (Khmer)

Watch full step-by-step video tutorial below to see how to configure Account Lockout Policy in Windows Server 2022 in Khmer:

---

Hope this tutorial help you configure Account Lockout Policy easily! Practice setting up account security policies on your domain today. Happy learning my friends! Sharing is caring!