# Ensure 'Account lockout duration' is set to '15 or more minute(s)

Necessity: The 'Account lockout duration' setting determines the number of minutes a locked-out account remains locked before it is automatically unlocked. This policy is a critical defense against online brute-force password guessing attacks. By enforcing a lockout period, the system significantly slows down attackers, making it computationally infeasible to guess passwords in a short time frame. A misconfiguration, such as setting the duration to zero or a very low value, effectively nullifies the account lockout threshold and exposes accounts to rapid, automated password attacks.

Auditing and Remediation: The audit script reads the current value of the 'LockoutDuration' from the system's local security database to verify compliance. The remediation script directly modifies this policy setting, using system tools to apply the specified duration in minutes, thereby enforcing the security requirement.

Recommended State Rationale:
- Basic: A duration of 15 minutes is a widely accepted baseline, recommended by benchmarks like CIS. It provides a meaningful delay to deter automated attacks while minimizing disruption for legitimate users who might accidentally lock their accounts.
- Moderate: Increasing the duration to 30 minutes enhances security by doubling the time penalty for each series of failed login attempts. This further discourages attackers without imposing an excessive wait time for users.
- Strict: A duration of 60 minutes or more is suitable for high-security environments. This extended lockout period acts as a powerful deterrent, significantly increasing the time and resources an attacker would need for a successful brute-force attack and raising the probability of detection by security monitoring systems.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[15, 'upper bound']` |
| **Moderate** | `[30, 'upper bound']` |
| **Strict** | `[60, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that queries the local security policy for the 'LockoutDuration' setting. The script must parse the output to return only the numerical value representing the lockout duration in minutes. For example, if the setting is 15 minutes, the script should output only the integer `15`.

## Remediation Script Working

PowerShell script that sets the 'Account lockout duration' by accepting a single positional command-line argument for the desired number of minutes. The script will configure the 'LockoutDuration' setting in the local security policy. It must return `$true` if the operation is successful and `$false` if it fails.

