# Ensure 'Account lockout threshold' is set to '5 or fewer invalid logon attempt(s), but not 0'

Necessity: The 'Account lockout threshold' policy determines the number of failed sign-in attempts that will cause a user account to be locked. This is a critical defense mechanism against online brute-force password-guessing attacks. A properly configured threshold can thwart automated attacks by locking the account after a small number of failed attempts, preventing the attacker from continuing. Setting this value to 0 disables the feature entirely, leaving accounts highly vulnerable. Auditing and Remediation: The audit script reads the current value of the 'LockoutBadCount' parameter from the system's security database. The remediation script directly modifies this same parameter to enforce the desired number of allowed invalid logon attempts. Recommended State Rationale: Basic ([5, 5]) provides a foundational level of protection that aligns with many security frameworks, preventing casual brute-force attempts without being overly disruptive to users who may occasionally mistype their password. Moderate ([3, 3]) significantly enhances security by reducing the window of opportunity for an attacker, offering a strong balance between security and user convenience, and is a common recommendation in benchmarks like CIS. Strict ([1, 1]) offers the highest level of protection by locking an account after a single failed attempt. This is suitable for high-security environments but can increase administrative overhead due to legitimate user lockouts.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[5, 1]` |
| **Moderate** | `[3, 1]` |
| **Strict** | `[1, 1]` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that retrieves the 'Account lockout threshold' from the local security policy. The script must query the 'LockoutBadCount' setting and output only its numeric value (e.g., '5') with no additional text or labels.

## Remediation Script Working

PowerShell script that accepts a single, positional numeric argument representing the desired 'Account lockout threshold'. The script must configure the system's 'LockoutBadCount' setting to this value and must output the boolean '$true' upon successful application or '$false' if it fails.

