Configure Account Lockout Policy in Windows 11

Configuring account lockout policies in Windows 11 protects your system against brute-force password attacks by automatically locking an account after a specified number of failed sign-in attempts. This guide explains how to set the account lockout threshold, the lockout duration, and the counter reset window using both the Local Security Policy tool and the Command Prompt.

Method 1: Using Local Security Policy (Windows 11 Pro, Enterprise, and Education)

1. Press Win + R, type secpol.msc, and press Enter to open the Local Security Policy editor.
2. In the left pane, expand Account Policies and select Account Lockout Policy.
3. In the right pane, double-click Account lockout threshold.
   • Enter the number of invalid logon attempts allowed before the account is locked (e.g., 5). Setting this to 0 disables lockout.
   • Click Apply.
4. A prompt will suggest default values for the duration and reset window. Click OK to accept them, or adjust them manually:
   • Account lockout duration: Double-click this policy to define how many minutes the account remains locked (e.g., 30 minutes). Setting it to 0 requires an administrator to manually unlock the account.
   • Reset account lockout counter after: Double-click this policy to set the number of minutes that must elapse after a failed attempt before the counter resets to zero (must be less than or equal to the lockout duration).
5. Click Apply and OK on each dialog, then close the window.

Method 2: Using Command Prompt (All Windows 11 Editions)

1. Press Win + S, type cmd, right-click Command Prompt, and select Run as administrator.

2. To view your current lockout settings, run:

   net accounts

3. To set the Account Lockout Threshold (number of failed attempts before lockout, from 1 to 999):

   net accounts /lockoutthreshold:5

4. To set the Account Lockout Duration (time in minutes the account stays locked, from 1 to 99999):

   net accounts /lockoutduration:30

5. To set the Reset Lockout Counter Window (time in minutes before the failed attempt counter resets):

   net accounts /lockoutwindow:30

6. Run net accounts again to verify that your new settings have been applied successfully.