https://www.techtarget.com/searchsecurity/tip/Account-lockout-policy-Setup-and-best-practices-explained
After decades of use, account lockout policies continue to be a simple yet effective way of thwarting authentication-based attacks. This best practice of setting parameters for locking users' accounts after too many login attempts helps prevent malicious actors from infiltrating networks.
When setting an account lockout policy, however, security, network and system admins must balance security and UX. It's important to keep attackers out, but also not to frustrate legitimate users -- and overload the help desk with reset requests -- when they type in an incorrect password.
Let's look at the main elements of an account lockout policy and review best practices for creating and implementing effective account lockout policies for your organization.
An account lockout policy temporarily blocks access to a user account when there have been too many failed authentication attempts for that account. Most OSes and domain services, such as Active Directory, have settings for configuring automatic account lockouts. Many websites, services and other online resources also support automatic lockouts.
The primary benefit of account lockout policies is preventing attackers from gaining unauthorized access to user accounts. It prevents brute-force attacks, which are attacks in which malicious actors try hundreds, thousands, millions or even billions of passwords to log into users' accounts. Types of brute-force attacks include credential stuffing, dictionary attacks, password spraying and rainbow table attacks. With an account lockout policy in place, attackers find themselves unable to make another attempt for some period of time after just a few failed logins.
Account lockouts can also indicate a pending cyberattack, providing an early warning sign of a potential incident.
The main challenge with using account lockout policies is that they can inconvenience or disrupt legitimate users. A user who accidentally enters the wrong password a few times, for example, would trigger an account lockout. Likewise, an attacker could lock out a legitimate user from their account with password guessing, or do password guessing against many of an organization's accounts and lock them all out.
Defining an effective account lockout policy is all about balancing security and availability. Most account lockout policies support the following options:
Some systems also support a variant on account lockout known as authentication backoff. After a few failed authentication attempts for an account occur, the system adds a short delay -- usually in seconds -- before the next attempt can be tried. Every time another failed authentication happens, a longer delay is introduced, with delays eventually reaching minutes long. This can provide strong protection against password-guessing attacks without significantly inconveniencing users who make a few mistakes.
Admins should include the details of the account lockout policy within the organization's password policy and inform users about policy settings during security awareness training.
Implementing an account lockout policy can inadvertently lock out legitimate users and even disrupt operations, so it's best done gradually. Follow these steps for an organized, efficient policy rollout:
Karen Scarfone is the principal consultant at Scarfone Cybersecurity in Clifton, Va. She provides cybersecurity publication consulting to organizations and was formerly a senior computer scientist for NIST.
03 Jun 2025