Set an account lockout policy against RDP password guessing

Bots that find a Remote Desktop port try thousands of passwords. An account lockout policy stops that: after a few wrong passwords in a row, Windows refuses all sign-ins for that account for a set time. Guessing becomes far too slow to work. This guide explains the three settings, picks values that protect you without causing constant lockouts, and shows how to get back in if you lock yourself out.

Before you start

• Administrator access over Remote Desktop to 203.0.113.10:3389.
• A tested second administrator account. See Create a backup administrator account.
• Access to the browser console in your VPS provider's control panel.

The three settings

All three are in Local Security Policy (secpol.msc) under Account Policies → Account Lockout Policy:

• Account lockout threshold: how many failed sign-ins trigger a lockout. 0 means accounts never lock.
• Account lockout duration: how many minutes a locked account stays locked before unlocking by itself.
• Reset account lockout counter after: how many minutes after the last failed attempt the counter goes back to zero. It must be equal to or less than the duration.

There is also Allow Administrator account lockout. When enabled, the built-in Administrator account can be locked out over the network, including Remote Desktop, just like other accounts. On recent Windows versions it may already be enabled by default.

Choose sensible values

A good balance for a small server:

• Threshold: 5 failed attempts
• Duration: 15 minutes
• Reset counter after: 15 minutes

With these values, a bot gets at most 5 guesses every 15 minutes per account, which makes guessing a strong password impossible in practice. A person who mistypes a few times only waits 15 minutes.

Avoid a very low threshold, such as 1 or 2. Saved but outdated passwords in an RDP app can lock you out after a single reconnect attempt. Avoid a duration of 0 too, which means "locked until an admin unlocks it". On a server you reach mainly over RDP, that can leave you with no way in except the console.

Check the current policy

Recent Windows builds may already ship with a lockout policy. Check first, in an elevated prompt:

net accounts

Look for these lines:

Lockout threshold:                                    Never
Lockout duration (minutes):                           30
Lockout observation window (minutes):                 30

Never means no lockout policy is set.

Set the policy

With net accounts

net accounts /lockoutthreshold:5 /lockoutduration:15 /lockoutwindow:15

/lockoutwindow is the Reset account lockout counter after setting.

With Local Security Policy

1. Press Win + R, type secpol.msc and press Enter.
2. Open Account Policies → Account Lockout Policy.
3. Double-click Account lockout threshold, enter 5 and click OK. Windows suggests values for the other two settings. Accept or adjust them to 15 minutes.
4. Optionally enable Allow Administrator account lockout.
5. Run gpupdate /force.

Check it works

Test with a throwaway account, not your own:

1. Create a test user and add it to Remote Desktop Users.
2. From your computer, connect to 203.0.113.10:3389 and enter the wrong password for that user five times.
3. The sixth attempt, even with the right password, should fail with a message that the account is locked.
4. On the server, confirm the lockout in Event Viewer: Windows Logs → Security, event ID 4740 (a user account was locked out).
5. Delete the test user when you are done.

Unlock an account

• Wait it out. The account unlocks by itself after the lockout duration.
• Unlock as another admin. Open lusrmgr.msc, open the user under Users, untick Account is locked out and click OK.
• Locked out of every admin account: open the browser console from your VPS provider's control panel and sign in there. If that also refuses, wait for the duration to pass and try again.

Find who is guessing

Failed sign-ins are logged as event ID 4625 in the Security log. To see recent ones with the source IP:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 |
  ForEach-Object { $_.Properties[5].Value + '  ' + $_.Properties[19].Value }

The first column is the username tried and the second is the source address. Repeated IPs are good candidates for a firewall block. See Audit failed RDP logins.

Troubleshooting

• Your account keeps locking: bots are targeting your username, or an old saved password is retrying. Rename the account and clear saved credentials on your devices.
• Event 4740 is missing: auditing for account management may be off. Check auditpol /get /category:"Account Management".
• Values cannot be saved: the reset counter must not be longer than the duration. Lower it first.
• Lockout seems not to apply to Administrator: Allow Administrator account lockout is disabled. Enable it if you want the built-in account protected the same way.

Next steps

• Block repeat offenders: Block RDP brute-force attacks.
• Make passwords harder to guess: Set a strong password policy on Windows Server.