Account lockout threshold
This security setting specifies how many failed sign-in attempts Windows counts before locking an account.
since 0.9.8.11
Purpose
Security policy: [System Access] LockoutBadCount = 10
This security setting specifies how many failed sign-in attempts Windows counts before locking an account. The entry [System Access] LockoutBadCount = 10 establishes a threshold of ten attempts. When the counter reaches the tenth failed attempt, the affected account can no longer be used for authentication while it remains locked.
The lockout ends when the period defined by Account lockout duration expires or when the account is administratively unlocked. The Reset account lockout counter after setting determines which failures accumulate toward the threshold: if its time window elapses after a failure without another counted failure, Windows resets the counter.
Notes
Security
The threshold limits the number of password attempts that can be made against an account before Windows blocks further authentication with that account. This substantially impedes automated online password-guessing attacks. It does not protect password hashes obtained outside the normal Windows authentication process or prevent other offline password attacks.
Account lockout can also be abused for denial of service. An attacker who can submit sign-in attempts for a known account can lock that account by causing ten counted failures without knowing its password.
Possible side effects
Legitimate users can lock themselves out through repeated typing mistakes. Counted authentication failures are not necessarily limited to passwords entered interactively: applications, services, or devices that retain outdated credentials can repeatedly submit an incorrect password and increase the counter.
Sign-ins and other authentication attempts using the affected account fail while it is locked. LockoutBadCount does not determine how long that condition lasts; the separate Account lockout duration setting controls the duration.
Notes
When applied as a local security policy, LockoutBadCount governs the computer's local account database. Lockout policy for Active Directory domain accounts is enforced by domain controllers according to the effective domain policy and is not established by this local INF entry. On a domain-joined computer, centrally delivered account policies can also determine the effective local settings.
On supported Windows versions, whether the built-in local Administrator account is subject to this threshold also depends on the separate Allow Administrator account lockout security setting.
Microsoft documentation
Microsoft Learn: Account lockout threshold
Microsoft Learn: Net commands for operating systems
Microsoft Learn: DeviceLock policy CSP
Microsoft Open Specifications: Account Lockout Policies