# Ensure 'Allow Administrator account lockout' is set to 'Enabled' (Manual)

Necessity: This setting is crucial for mitigating brute-force password guessing attacks against privileged accounts. By default, the built-in Administrator account (SID ending in -500) is immune to account lockout policies, making it a primary target for attackers. While this immunity cannot be directly removed, enabling the account lockout policy ensures that all *other* administrative accounts are protected. The best practice is to disable the built-in Administrator account and use other, non-exempt administrator accounts, which will then be subject to lockout. Failure to enforce account lockout leaves a critical vector open for system compromise. Auditing and Remediation: The audit script effectively checks if an account lockout policy is active by verifying that the 'Account lockout threshold' is set to a number greater than zero. A value of '0' means account lockout is disabled. The remediation script configures this same threshold. Passing 'Enabled' sets a secure, non-zero threshold to activate the policy, while 'Disabled' sets it to zero, deactivating it. Recommended State Rationale: Basic: ['Enabled'] - This is a foundational security control recommended by nearly all major security frameworks (CIS, NIST, etc.). Enabling account lockout is the minimum acceptable state to protect against basic brute-force attacks. Moderate: ['Enabled'] - There is no intermediate state for this setting. The account lockout mechanism is either active or it is not. Therefore, a moderate security posture also requires it to be enabled. Strict: ['Enabled'] - In a strict security environment, it is non-negotiable to have a lockout policy in place. The stringency in a strict environment would be further defined by the specific threshold, duration, and reset counter values, but the master setting must be enabled.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the 'Account lockout threshold' from the local security policy. If the value is greater than 0, the script must output the string 'Enabled'. If the value is 0, it must output the string 'Disabled'. The script's output must only be the resulting string value, with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts one positional argument: either 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must set the 'Account lockout threshold' to a recommended value (e.g., 5). If the argument is 'Disabled', it must set the threshold to 0. The script must return $true upon successful application of the setting and $false on failure.

