How to Enable or Disable Built-in Administrator Account Lockout in Windows 11

Why Account Lockout Matters

Account lockout stops unauthorized users from guessing your password by locking your Windows 11 account after a set number of failed login attempts. This security feature protects your personal data from hackers and keeps your computer safe by blocking access when someone types the wrong password too many times in a row.

The Account Lockout Policy in Windows manages user account locking. This policy prevents hackers from guessing passwords by blocking an account after a predetermined number of wrong login attempts, for example, 5 attempts.

Understanding the Settings

Windows 11 account lockout settings control how your PC handles repeated incorrect login attempts by defining when an account locks, how long it stays locked, and how quickly the failure counter resets. Adjusting these rules lets you balance your computer’s security against the risk of getting locked out yourself.

Account lockout duration is the number of minutes a Windows 11 account remains locked before automatically unlocking. An administrator can also manually unlock the account at any time.

Reset account lockout counter after: This is how many minutes must pass before the failed login counter resets to zero.

Administrator account lockout in Windows 11: This setting determines if the special Administrator account on your computer can be temporarily blocked from use. Blocking the Administrator account prevents anyone from accessing it after too many incorrect password attempts, adding a security layer.

The Security Trade-off

Limiting failed login attempts stops most hacking. However, a bad actor could lock out all user accounts at once. This action is a denial-of-service attack.

New Default Settings

Windows 11 default account lockout rules lock your PC for 10 minutes after 10 failed password attempts, starting with update build 22528. These built-in security defaults apply to standard user profiles as well as the main administrator account to protect your system right out of the box.

• Account lockout threshold: 10 failed attempts
• Account lockout duration: 10 minutes
• Allow Administrator account lockout: Enabled
• Reset account lockout counter after: 10 minutes

References:

Account Lockout Policy - Windows 10

Describes the Account Lockout Policy settings and links to information about each policy setting.

KB5020282—Account lockout available for built-in local administrators - Microsoft Support

Important Requirements

This feature is only available in Windows 11 Pro, Enterprise, and Education editions.

How to Enable or Disable Administrator Account Lockout

1. [Admin Required] Open Local Security Policy. Press the Windows key and search for secpol.msc, then press Enter.
2. In the left pane, click on Account Policies to expand it. Then click on Account Lockout Policy.
3. In the right pane, double-click on Allow Administrator account lockout to open its settings.
4. Note: The Account lockout threshold policy must be enabled first to change this setting.
5. Select Enabled (the default) or Disabled for what you want. Then click OK.
6. If you want, you can also change the Account lockout threshold, Account lockout duration, and Reset account lockout counter after settings.
7. When you're done, you can close the Local Security Policy window.

Summary

Windows 11 now defaults to locking accounts for 10 minutes after 10 failed attempts, but you can change this using Local Security Policy on Pro, Enterprise, or Education versions.