How to Change Reset Account Lockout Counter After Time in Windows 11

What Is Account Lockout?

Account lockout is a security feature in Windows that stops people from guessing your password too many times. When an account is locked, it prevents further login attempts for a set period, protecting your computer from unauthorized access.

The Account Lockout Policy settings control when an account gets locked and what happens afterward.

Important Policy Settings

Windows has several account lockout policy settings that control how your account is protected. Key settings include the ‘account lockout threshold’ (how many wrong passwords lock an account), the ‘account lockout duration’ (how long it stays locked), and the ‘reset account lockout counter after’ time.

Account lockout duration: This is how many minutes a locked account stays locked before it unlocks on its own. An admin can also unlock it faster.

Reset account lockout counter after: This is the number of minutes that must pass after a failed login before the counter resets to zero.

Allow Administrator account lockout: This decides if the Administrator account can be locked.

Why This Matters

Understanding account lockout matters because it’s a key defense against password guessing attacks. By limiting failed login attempts, it stops automated tools from cracking your password, and also prevents denial-of-service attacks where someone locks accounts on purpose.

References:

Account Lockout Policy – Windows 10

Describes the Account Lockout Policy settings and links to information about each policy setting.

Reset account lockout counter after – Windows 10

Describes the best practices, location, values, and security considerations for the Reset account lockout counter after security policy setting.

New 🪟 Windows 11 Defaults

Starting with Windows 11 build 22528 and higher, the defaults are now:

• Account lockout threshold: 10 failed tries
• Account lockout duration: 10 minutes
• Allow Administrator account lockout: Enabled
• Reset account lockout counter after: 10 minutes

Note: You must be signed in as an administrator to change these settings.

Option 1Use Local Security Policy

You can change account lockout settings using the Local Security Policy tool, but this option is only available on Windows 10/11 Pro, Enterprise, and Education editions. To use it, search for ‘secpol.msc’ and open it with administrator privileges to find the Account Policies section.

1. Open Local Security Policy. Press the Windows key and search for secpol.msc. Click it to open. ⚠️ Requires admin privileges
2. Find Account Lockout Policy. In the left pane, click on Account Policies to expand it. Then click on Account Lockout Policy.
3. Open Reset account lockout counter after. In the right pane, double-click on “Reset account lockout counter after” to open it.
4. Enter the new time. Type a number between 1 and 99999 minutes. This is how long must pass before the failed login counter resets to zero. Click OK.

Important: First, make sure the ‘Account lockout threshold’ is enabled. Also, the ‘Account lockout duration’ must be greater than or equal to the ‘Reset account lockout counter after’ setting. The default is 10 minutes.

5. Check Account lockout duration. If Reset account lockout counter after is set higher than Account lockout duration, a popup will show suggested values. Click OK to confirm and update Account lockout duration.
6. Change other settings (optional). You can also change Account lockout duration, Account lockout threshold, and Allow Administrator account lockout here.
7. Close the window. When done, close Local Security Policy if you want.

Option 2Use Windows Terminal

If you have a Windows edition other than Pro, Enterprise, or Education, you can use Windows Terminal to manage account lockout settings. Open Windows Terminal as an administrator, then you can use commands like ‘net accounts’ to check your current settings.

1. Open Windows Terminal as admin. Press the Windows key and search for Windows Terminal. Right-click it and select “Run as administrator.” ⚠️ Requires admin privileges Select either Windows PowerShell or Command Prompt.
2. Check current settings. Copy and paste this command and press Enter:
   net accounts
   

   Look for “Lockout observation window (minutes)” to see the current setting.

3. Change the setting. Copy and paste this command and press Enter:
   net accounts /lockoutwindow:<number>
   Replace <number> with a number between 1 and 99999 minutes. For example: net accounts /lockoutwindow:10

Important: First, make sure the ‘Account lockout threshold’ is enabled. Also, ensure the ‘Lockout duration’ (in minutes) is greater than or equal to the ‘Lockout observation window’ (in minutes). The default is 10 minutes.

4. Change other settings (optional). You can also change Account lockout threshold, Allow Administrator account lockout, and Reset account lockout counter after policies with other commands.
5. Close Windows Terminal. When done, close Windows Terminal if you want.

Summary

Account lockout is a vital security feature that locks your Windows account after too many incorrect password attempts. You can adjust these settings, including how long the counter resets, using either the Local Security Policy tool on specific Windows editions or Windows Terminal on any edition.