Account lockout duration
This security setting specifies how many minutes a locked account remains locked before Windows unlocks it automatically.
since 0.9.8.11
Purpose
Security policy: [System Access] LockoutDuration = 2
This security setting specifies how many minutes a locked account remains locked before Windows unlocks it automatically. A value of 2 sets a two-minute lockout period. During that period, the affected account cannot be used for a new sign-in unless it is unlocked administratively first.
The setting takes effect only when the separate Account lockout threshold setting causes accounts to be locked after a specified number of failed sign-in attempts. If that threshold is 0, failed attempts do not lock accounts and LockoutDuration has no practical effect.
Notes
Security
A two-minute lockout briefly interrupts automated password guessing against an account, but attempts can resume after a relatively short delay. It therefore provides less throttling than a longer lockout duration. The overall protection also depends on the account lockout threshold and the interval configured by Reset account lockout counter after.
Account lockout can be abused for denial of service. An attacker who can generate enough invalid sign-in attempts can temporarily make a known account unavailable. The two-minute duration limits each automatic lockout period, but it does not prevent subsequent failed attempts from triggering another lockout.
Possible side effects
Legitimate users who accidentally exceed the failed-attempt threshold can be prevented from signing in for up to two minutes. Automatic unlocking reduces the need for administrative intervention compared with an indefinite lockout.
Notes
LockoutDuration is an account-lockout policy key in the [System Access] section of a Windows security template. Its value is interpreted as a decimal number of minutes; it is not a registry value or an ADMX policy.
When account lockout is enabled, Windows requires the lockout duration to be greater than or equal to the period specified by Reset account lockout counter after (ResetLockoutCount).
When applied locally to a stand-alone or member computer, this setting belongs to the computer's local account policy and applies to local user accounts. Domain accounts remain governed by the domain account policy enforced by domain controllers.
Microsoft documentation
Microsoft Learn: Account lockout duration
Microsoft Learn: Account Lockout Policies security-template keys