# Ensure 'Account lockout threshold' is set to '5 or fewer invalid logon attempt(s), but not 0'

Necessity: The 'Account lockout threshold' policy determines the number of failed sign-in attempts that will cause a user account to be locked. This is a critical defense mechanism against online password guessing and brute-force attacks. An attacker with unlimited attempts could eventually guess a user's password. By locking the account after a small number of failed attempts, this policy effectively thwarts such attacks. Setting this value to 0 disables the policy, creating a significant security vulnerability.

Auditing and Remediation: The audit script retrieves the current numeric setting for the lockout threshold from the local security policy. The remediation script modifies this setting by executing the 'net accounts' command with the new, desired threshold value provided as an argument.

Recommended State Rationale:
- Basic ([5, 5]): This state provides a foundational level of protection against brute-force attacks. It allows for a reasonable number of user errors before locking an account, minimizing support calls while still deterring unsophisticated attacks. This is a common baseline recommendation, including in CIS Benchmarks.
- Moderate ([4, 4]): A moderate setting reduces the number of allowed attempts, offering a stronger defensive posture by shortening the window for an attacker. This strikes a balance between enhanced security and user convenience.
- Strict ([3, 3]): This is a highly secure configuration suitable for environments with sensitive data. It severely limits an attacker's ability to guess passwords. However, it increases the likelihood of accidental user lockouts, necessitating an efficient help desk process for unlocking accounts.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[5, 1]` |
| **Moderate** | `[3, 1]` |
| **Strict** | `[1, 1]` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that queries the system's account policies for the 'Lockout threshold'. The script must parse the output and return only the numeric value. For example, if the threshold is 5, the script's standard output must be only '5'.

## Remediation Script Working

PowerShell script that accepts a single integer as a positional command-line argument. The script must use this argument to set the 'Account lockout threshold' via the 'net accounts /lockoutthreshold' command. The script must return the boolean value $true on successful configuration and $false on failure.

