How to Change Account Lockout Duration in Windows 11

Why Account Lockout Matters

Account lockout matters because it acts as a primary security defense, stopping unauthorized users from repeatedly guessing passwords to gain access to your computer.

Understanding Account Lockout Settings

Account lockout settings in Windows 11 safeguard your PC by locking accounts after excessive incorrect password guesses. Unauthorized intruders rely on automated attempts to break into systems, making this feature vital. Defining the allowed wrong tries and lockout duration secures personal data effectively.

The account lockout threshold determines how many incorrect password entries are allowed before Windows locks the account. Security administrators can configure this limit anywhere from 1 to 999 attempts. Setting the account lockout threshold to 0 disables automatic account locking due to excessive failed login attempts.

Account lockout duration defines how many minutes an account remains locked before automatically unlocking. Administrators also possess the capability to manually unlock any locked account.

The “Reset account lockout counter after” setting determines how many minutes must pass after a failed login attempt before the count of incorrect login attempts resets to zero. This ensures that a user has a specific window of time to correct their password before the lockout policy is triggered again.

The Administrator account lockout option determines if the primary Administrator account can be locked out. Allowing this lockout prevents unauthorized access to critical system functions for at least 15 minutes, enhancing security after too many failed login attempts.

Default Settings in 🪟 Windows 11

For Windows 11 build 22528 and newer, the default settings are:

• Account lockout threshold: 10 failed attempts
• Account lockout duration: 10 minutes
• Allow Administrator account lockout: Enabled
• Reset account lockout counter after: 10 minutes

⚠️ Admin Required: You must be signed in as an administrator to change these settings.

Important Notes

Malicious actors sometimes attempt to lock out all accounts in an organization by repeatedly entering wrong passwords across various profiles.

Option 1Using Local Security Policy

The Local Security Policy tool handles these adjustments, though this built-in management console requires Windows Pro, Enterprise, or Education editions. Press the Windows key, type `secpol.msc`, and press Enter to open the Local Security Policy editor.

1. Open Local Security Policy. Type secpol.msc in the search box and press Enter.
2. In the left pane, double-click Account Policies to expand it, then click Account Lockout Policy.
3. In the right pane, double-click Account lockout duration to open it.
4. Type a number between 0 and 99999 minutes. This is how long the account stays locked. Click OK.

   • 0 = The account stays locked until an admin unlocks it
   • 10 = The default setting
5. If Account lockout duration is lower than Reset account lockout counter after, you will see suggested values. Click OK to accept them.
6. If you want, you can also change the Account lockout threshold, Allow Administrator account lockout, and Reset account lockout counter after settings.
7. Close Local Security Policy when done.

Option 2Using Windows Terminal

Windows Terminal offers another way to change the account lockout duration in Windows 11, and this method works across most versions. You must open Windows Terminal as an administrator first. Right-click the Start menu and select 'Terminal (Admin)' to begin making changes to your lockout settings.

1. Right-click the Start menu and select Terminal (Admin), or search for Windows Terminal and run it as admin. Choose either Windows PowerShell or Command Prompt.
2. Copy and paste this command, then press Enter to see your current lockout duration:
   net accounts
   

   Look for the line that says "Lockout duration (minutes)".
3. Type this command and press Enter:
   net accounts /lockoutduration:<number>
   

   Replace <number> with a value between 0 and 99999 minutes. For example:

   net accounts /lockoutduration:10
4. If you want, you can also change other settings using these commands:

   • Account lockout threshold: net accounts /lockoutthreshold:<number>
   • Reset account lockout counter: net accounts /lockoutwindow:<number>
5. Close Windows Terminal when done.

Summary

Configuring how long a Windows 11 account stays locked after failed login attempts requires either the Local Security Policy tool or Windows Terminal.

References

Account Lockout Policy - Windows 10 - Describes the Account Lockout Policy settings and links to information about each policy setting.

Account lockout duration - Windows 10 - Describes the best practices, location, values, and security considerations for the Account lockout duration security policy setting.