# Ensure 'Account lockout duration' is set to '15 or more minute(s)

The 'Account lockout duration' policy determines the number of minutes a locked-out account remains locked before it is automatically unlocked. **Necessity:** This setting is a critical defense against online brute-force password guessing attacks. By locking an account for a set period after several failed login attempts, it significantly increases the time and resources required for an attacker to succeed, making such attacks impractical. A setting of zero or a very low value would allow an attacker to make continuous password guesses, eventually compromising the account. **Auditing and Remediation:** The audit script reads the local security policy database to retrieve the current value for `LockoutDuration`. The remediation script uses the `secedit` command-line tool to directly modify this setting, creating and applying a security template with the desired value. **Recommended State Rationale:** **Basic ([15, 15]):** A 15-minute lockout is a common industry baseline (e.g., CIS Benchmark Level 1), providing a significant deterrent to automated attacks without causing excessive disruption to legitimate users. **Moderate ([30, 30]):** A 30-minute duration further enhances security by doubling the penalty time for an attacker, increasing the window for detection and response. **Strict ([60, 60]):** A 60-minute lockout offers a very strong security posture, making brute-force attempts extremely slow and inefficient. While some standards recommend setting the duration to require administrator reset (value of 0), this can create a denial-of-service risk and operational overhead. A 60-minute duration provides a balance of high security and eventual automatic recovery.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[15, 'upper bound']` |
| **Moderate** | `[30, 'upper bound']` |
| **Strict** | `[60, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that exports the local security policy using `secedit.exe /export` and parses the resulting configuration file to extract the value of `LockoutDuration`. The script must return only the numerical value and nothing else.

## Remediation Script Working

PowerShell script that accepts a single positional integer argument for the number of minutes. The script will use `secedit.exe /configure` to set the `LockoutDuration` in the local security policy to the provided value. The script must return `$true` on successful application and `$false` on failure.

