Reset account lockout counter after
This account lockout setting specifies, in minutes, when Windows resets the failed sign-in attempt counter to `0`.
since 0.9.8.11
Purpose
Security policy: [System Access] ResetLockoutCount = 2
This account lockout setting specifies, in minutes, when Windows resets the failed sign-in attempt counter to 0. With ResetLockoutCount = 2, the counter returns to zero when two minutes have elapsed since the most recent failed sign-in attempt without another failure occurring.
The setting has an effect only when the account lockout threshold is greater than 0. It does not determine how many failures lock an account or how long an account remains locked after reaching the threshold. The separate Account lockout duration setting controls the latter behavior.
Notes
Security
A two-minute observation window prevents failed attempts that are spaced farther apart from accumulating toward the account lockout threshold. This reduces the likelihood that isolated typing errors will eventually cause an unintended lockout.
The short window also makes deliberately slow password guessing easier to keep below the lockout threshold: attempts separated by at least two minutes do not accumulate together. Rapid brute-force attempts remain subject to the configured account lockout threshold if enough failures occur within the window.
Possible side effects
Multiple legitimate sign-in failures within the same two-minute period still accumulate and can lock the account. Resetting the failure counter does not unlock an account that is already locked; subsequent account availability depends on the account lockout duration or an administrative unlock.
Notes
ResetLockoutCount is the corresponding entry in the [System Access] section of a Windows security template. Its numeric value represents minutes. When an account lockout threshold is enabled, Microsoft documents that the reset interval must not exceed the account lockout duration.
When applied as a local security policy on a workstation or member server, the setting affects the applicable lockout policy for local accounts. Domain-account lockout is governed by the domain account policy enforced by domain controllers.
Microsoft documentation
Microsoft Learn: Reset account lockout counter after
Microsoft Learn: Account policies