Activate remote access client account lockout
Warning
If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
The failed attempts counter is periodically reset to zero (0). It's automatically reset to zero after the reset time in the following situation:
An account is locked out after the maximum number of failed attempts.
To activate remote access client account lockout and reset time, follow these steps:
-
Select Start > Run, type
regeditin the Open box, and then press ENTER. -
Locate and then select the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout -
Double-click the MaxDenials value.
The default value is zero. It indicates that account lockout is turned off. Type the number of failed attempts before you want the account to be locked out.
-
Select OK.
-
Double-click the ResetTime (mins) value.
The default value is 0xb40 that is hexadecimal for 2,880 minutes (two days). Modify this value to meet your network security requirements.
-
Select OK.
-
Quit Registry Editor.
Manually unlock a remote access client
If the account is locked out, the user can try to log on again after the lockout timer has run out. Or, you can delete the DomainName:UserName value in the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout
To manually unlock an account, follow these steps:
-
Select Start > Run, type
regeditin the Open box, and then press ENTER. -
Locate and then select the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout -
Find the Domain Name:User Name value, and then delete the entry.
-
Quit Registry Editor.
-
Test the account to confirm that it's no longer locked out.
Note: Must Update Group Policy
Open Command Prompt in the Windows Recovery Environment, paste gpupdate /force in the terminal, and press Enter.
References
For more information about the remote access client lockout feature, see Account Lockout Policy.
