Account Lockout Policy in Windows 11 and 10: Set and Unlock

An account lockout policy makes Windows lock an account after a set number of wrong passwords, for a set number of minutes. You can set it on any edition, including Windows 11 Home, with one command in an administrator Command Prompt: net accounts /lockoutthreshold:5 /lockoutduration:15 /lockoutwindow:15. On Pro, Enterprise and Education you can also use Local Security Policy under Account Policies, Account Lockout Policy. The part most people do not know: your PC may already have one. Every new Windows 11 installation since version 22H2 ships with a default of 10 failed attempts within 10 minutes, then a 10-minute lockout, and it applies to administrator accounts too. This guide shows how to check what you have, how to set or change it, how to unlock a locked account, the one rule that makes the command fail with an error, and how IT teams should set it across a fleet.

Jake found out about the default the embarrassing way. A customer's nine-year-old had spent a rainy afternoon guessing her dad's laptop password, and when the dad got home, Windows told him the account was locked and to try again later. He brought the laptop in convinced it had a virus. Jake, who had set that laptop up himself, had never configured a lockout policy on it. Ethan explained over the counter: "You didn't. Microsoft did, the day you installed it. Ten wrong tries in ten minutes, ten minutes in the penalty box. The kid didn't break anything. The lock did exactly what it's for." The dad waited ten minutes, typed his password, and left with a story instead of a repair bill.

If you are here because you are locked out right now, skip to the unlock section; nothing else on this page matters until you are back in. If you are here to protect a PC from password guessing, read on, because the right numbers depend on what kind of account you use, and there is one real risk in setting the threshold too low.

What an account lockout policy is, in plain English

A lockout policy is three numbers working together. The threshold is how many wrong passwords are allowed. The observation window (Microsoft's policy name is "Reset account lockout counter after") is how long Windows remembers the wrong attempts before starting the count again. The lockout duration is how long the account stays locked once the threshold is reached. With 5, 15 and 15, five wrong passwords within fifteen minutes lock the account for fifteen minutes; four wrong passwords, then a coffee break, and the count starts over.

It exists to defeat guessing. Password-guessing tools can try thousands of passwords a minute against an account that never locks. A threshold turns that into a handful of guesses per lockout period, which makes guessing a real password effectively hopeless. It does nothing against someone who already knows the password, and nothing against attacks on a stolen password file, which never touch the sign-in screen at all.

The Windows 11 default you already have

For most of Windows' history the lockout threshold defaulted to 0, meaning accounts never locked, and the built-in Administrator account was excluded from lockout entirely so that an administrator could always get in to fix things. That changed with the October 11, 2022 cumulative updates and Windows 11 version 22H2. On new installations of Windows 11 22H2 and later, and on any new PC that had those October 2022 updates before its first setup, Windows now sets the lockout policy to 10 failed attempts within 10 minutes, locked for 10 minutes, and turns on a new policy, Allow Administrator account lockout, so the built-in Administrator is covered too.

Two details matter for real life. First, the built-in Administrator's lockout only applies to network sign-ins, such as Remote Desktop attempts; someone sitting at the keyboard can still sign in to it during a lockout, which keeps the "administrator can always get in to fix it" promise for physical access. Second, existing PCs that were upgraded to 22H2 or later did not get these defaults automatically; their policy is whatever it was before, very often 0. So a laptop set up fresh in 2025 locks after 10 tries, and a laptop upgraded from 2021 might never lock at all. The only way to know is to check.

How to check your current lockout policy

This works on every edition, including Home. Open Command Prompt as administrator and run:

net accounts

Among the password settings you will see three lines that matter here:

Lockout threshold:                 10
Lockout duration (minutes):        10
Lockout observation window (minutes): 10

A threshold of Never means no lockout policy is in effect. A threshold of 10 with 10-minute duration and window is the modern Windows 11 default. On Pro and above, the same values are visible in Local Security Policy: press Win + R, type secpol.msc, and open Security Settings > Account Policies > Account Lockout Policy. If a value there is grayed out, a domain Group Policy or a management tool such as Intune is setting it, and you should change it there, not locally; our guide to "This setting is managed by your administrator" explains how to tell.

How to set the lockout policy with net accounts (any edition)

This is the method that works on Windows 11 Home and Windows 10 Home, where the Local Security Policy tool is not available. Run each command in an administrator Command Prompt. Set the window and duration first, then the threshold, which avoids the common error described in the next section.

1. Set how long wrong attempts are remembered: net accounts /lockoutwindow:15
2. Set how long the account stays locked: net accounts /lockoutduration:15
3. Set the number of wrong attempts allowed: net accounts /lockoutthreshold:5
4. Confirm with net accounts.

You can also do it in one line, net accounts /lockoutthreshold:5 /lockoutduration:15 /lockoutwindow:15. Changes take effect immediately, with no restart. To turn lockout off entirely, set /lockoutthreshold:0; the duration and window then stop mattering.

The error that stopped the old version of this guide

The first version of this guide, written in 2016, told readers to set a 10-minute lockout duration and then added a strange note: "when you try this for the first time it will show some error, change 10 to 30 for now." It never said why. Here is why. Windows enforces one rule between the three numbers: the lockout duration must be equal to or longer than the observation window. On Windows 10 at the time, turning lockout on gave the window a default of 30 minutes; asking for a 10-minute duration while the window was still 30 broke the rule, and net accounts refused with an error. Setting the duration to 30 happened to satisfy the rule, which is why the workaround "worked."

The clean fix is simply to set the window first, or to set both in the same command, as in the steps above. If you want a 10-minute lockout, set /lockoutwindow:10 before /lockoutduration:10, and the error never appears. In Local Security Policy the same rule applies; Windows will offer to adjust the other value for you when you change one.

How to set it in Local Security Policy (Pro, Enterprise, Education)

1. Press Win + R, type secpol.msc, press Enter.
2. Open Security Settings > Account Policies > Account Lockout Policy.
3. Double-click Account lockout threshold and enter the number of attempts. Windows suggests values for the other two settings; accept or change them.
4. Set Account lockout duration and Reset account lockout counter after, keeping the duration equal to or longer than the reset time.
5. Decide on Allow Administrator account lockout. Enabled protects the built-in Administrator from remote guessing; it does not block sign-in at the keyboard.

If Local Security Policy is missing on a Home PC, that is expected, not broken; use the net accounts method. Tools that promise to "add gpedit to Home" are best avoided on a machine you care about.

How to unlock a locked account

You have three options, from simplest to most involved.

• Wait. A lockout ends by itself after the duration: 10 minutes on the Windows 11 default. If the duration is 0, the account stays locked until an administrator unlocks it, so waiting will not help.
• Unlock it from another administrator account (Pro and above). Press Win + R, type lusrmgr.msc, open Users, double-click the account, clear Account is locked out, and choose OK.
• Sign in as the built-in Administrator at the keyboard if it is enabled; its lockout only affects network sign-ins. Our guide to the built-in Administrator account explains when enabling it is sensible, and why it should be disabled again afterward.

If you sign in with a Microsoft account, remember that the password you type belongs to your online account. Repeated wrong passwords may also trigger Microsoft's own online protections, which have their own recovery flow at account.microsoft.com, separate from anything on the PC. And if you use a PIN, Windows Hello limits wrong PIN attempts on its own, using the device's security chip, and eventually asks you to type a challenge phrase before trying again; that is by design and ends with a correct PIN or the password. If Hello reports that your PIN is not available at all, that is a different problem; see "Something happened and your PIN isn't available".

See who is guessing: account lockout auditing on Windows 11

A lockout tells you that something went wrong; auditing tells you what. Windows records failed sign-ins in the Security event log, but only if auditing is turned on, and on many home PCs it is not. On Pro and above, open secpol.msc, go to Advanced Audit Policy Configuration > System Audit Policies > Logon/Logoff, and enable Audit Logon and Audit Account Lockout for both Success and Failure. From an administrator Command Prompt on any edition, the same thing is two commands:

auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable

After that, Event Viewer (Win + R, eventvwr.msc) shows each failed sign-in under Windows Logs > Security as event 4625, with the account name, the sign-in type and, for network attempts, the source address, and attempts against an account that is already locked also appear as 4625, with a failure reason saying the account is locked out. To record the moment of lockout itself, event 4740, also enable Audit User Account Management under Account Management. A steady stream of 4625 events from an address you do not recognize is the difference between "the kids were guessing" and "something on the internet is guessing," and it tells you whether the answer is a talk at dinner or closing Remote Desktop to the world. On Windows Server 2019, 2022 and 2025 the same policy and the same auditing apply, with the domain controller adding event 4740 for domain account lockouts.

What numbers to use: home, small office, company

There is no perfect setting; there is a trade between stopping guessers and locking out the people who own the account. Microsoft's own security baseline suggests a threshold of 10 as a reasonable starting point, and warns about a real risk of going too low: anyone who can reach the sign-in, over the network for example, can lock an account deliberately just by typing wrong passwords. A threshold of 3 on a shared office server is an invitation for one annoyed person to lock everyone out every morning.

Lockout is one layer, not the whole wall. A long password or, better, a Windows Hello PIN or fingerprint does more than any lockout number, because a PIN only works on that one device. Encrypting the drive with BitLocker protects the data even if someone takes the disk out and never touches the sign-in screen; if you rely on it, know where your BitLocker recovery key is. And Dynamic Lock locks the screen when your phone walks away with you, which prevents the most common "attack" of all, an unlocked PC left on a desk.

For IT admins: domain, Intune, Entra ID and troubleshooting lockouts

In a managed environment the same three numbers apply, but where you set them and how you investigate lockouts are different jobs.

• Active Directory domains: the domain lockout policy lives in the Default Domain Policy GPO under Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Account Lockout Policy. It applies to domain accounts. For different rules for admins and service accounts, use fine-grained password policies (Password Settings Objects) rather than extra GPOs, which do not apply account policies to domain users.
• Local accounts on member machines follow the local policy or a GPO linked to their OU. The Allow Administrator account lockout setting arrived with the October 2022 updates; on machines configured before then, set it explicitly by GPO, because it is not secure by default on upgraded systems.
• Intune: configure lockout for Windows devices through the settings catalog or security baselines (the DeviceLock and local security policy settings), and apply one source of truth: a device receiving both GPO and MDM values is a troubleshooting session waiting to happen.
• Microsoft Entra ID accounts are protected in the cloud by smart lockout, separate from Windows' local policy; its default threshold is 10 failed attempts with a 60-second initial lockout, and it distinguishes familiar from unfamiliar locations. On-premises and cloud lockouts are separate counters, so tune them with each other in mind.

Finding the source of repeated lockouts is the part that eats afternoons. On a domain controller, security event 4740 records that an account was locked out and names the caller computer; 4625 records each failed sign-in with a reason and source. The usual culprits are stale credentials: a phone still syncing mail with an old password, a mapped drive or scheduled task saved with old credentials, a service running as a user account, or a Remote Desktop session left open on another machine. Kerberos can also retry during encryption-type negotiation in mixed environments, so one human mistake may count more than once. Fix the source, not the threshold. And remember the denial-of-service trade: a low threshold on accounts whose names are known lets anyone on the network lock them; threshold 0 is only an option when complex passwords and robust failed-sign-in alerting are both in place.

Finally, pair lockout with Windows LAPS for local administrator accounts, so each machine has a unique, rotated local admin password; lockout slows guessing, and LAPS makes one guessed password worthless on every other machine.

The nine-year-old never did guess the password, which is the whole point. A lockout policy is the quiet kind of security that nobody notices until the day it works, and then it looks like a problem. Check yours with one command, set sensible numbers, and remember the one rule about duration and window. Jake now tells every customer the same thing when he hands back a laptop: "If it says you're locked out, it's not broken. Make a tea and try again in ten minutes."

Revision note. This guide was first published in November 2016 for the Windows 10 Anniversary Update. It was rewritten on September 29, 2026 for Windows 11 and Windows 10 from Microsoft's account lockout policy references and the KB5020282 change that set new defaults in October 2022. The unexplained workaround in the original is now explained, and sections on checking, unlocking, choosing values and managing lockout across a company were added.