Allow Administrator account lockout
A value of `1` makes the built-in local Administrator account subject to the account lockout policy.
since 0.9.8.11
Purpose
Security policy: [System Access] AllowAdministratorLockout = 1
A value of 1 makes the built-in local Administrator account subject to the account lockout policy. If the account exceeds the configured threshold for failed sign-in attempts, Windows locks it out from network logons, including Remote Desktop Protocol (RDP) logons.
This behavior applies specifically to the built-in Administrator account. It does not give other accounts in the local Administrators group any special lockout treatment.
Notes
Security
The setting limits automated password-guessing attempts against the highly privileged built-in Administrator account. Without this inclusion, an attacker could continue trying passwords for that account over the network despite a general account lockout policy.
The lockout mechanism can also be abused for denial of service: an attacker can deliberately generate enough failed attempts to prevent network logons with the account. According to Microsoft, local console logons remain available during the lockout period, so the setting does not completely disable the account for every logon type.
Possible side effects
Repeated incorrect password submissions can block legitimate network access that uses the built-in Administrator account. Network logons remain unavailable until the configured lockout duration expires or the account is unlocked.
Notes
AllowAdministratorLockout = 1 does not define the lockout threshold, lockout duration, or the interval after which the failed-attempt counter is reset. Its effective behavior depends on the other account lockout policy settings. If the account lockout threshold is 0, meaning that account lockout is disabled, this value alone cannot trigger a lockout.
Microsoft introduced this security setting with the October 11, 2022 cumulative updates and later updates for the applicable supported Windows versions.
Microsoft documentation
Microsoft Learn: Policy CSP – DeviceLock (AllowAdministratorLockout)
Microsoft Support: KB5020282—Account lockout available for built-in local administrators