How to Configure Domain Password and Account Lockout Policy
Applies to: Windows Server 2019, 2022 and 2025 domain environments.
Domain password and lockout settings reduce credential risk but can also create denial-of-service and support load if chosen without identity monitoring.
Test Group Policy in a controlled OU before production rollout. For managed Windows Server hosting, visit networkmanager.info.
Prerequisites
- Review current domain policy.
- Coordinate with MFA and service-account design.
- Choose thresholds from risk analysis.
- Test legacy applications.
Procedure
Step 1: Read current policy
Capture baseline.
Get-ADDefaultDomainPasswordPolicyStep 2: Set approved password values
This example is illustrative and must match organizational policy.
Set-ADDefaultDomainPasswordPolicy -Identity 'corp.example' -MinPasswordLength 14 -PasswordHistoryCount 24 -MaxPasswordAge 90.00:00:00 -MinPasswordAge 1.00:00:00 -ComplexityEnabled $trueStep 3: Set lockout controls
Use approved threshold and durations.
Set-ADDefaultDomainPasswordPolicy -Identity 'corp.example' -LockoutThreshold 10 -LockoutDuration 00:15:00 -LockoutObservationWindow 00:15:00Step 4: Review service accounts
Move suitable services to gMSA rather than exempting shared passwords.
Step 5: Communicate and monitor
Track lockouts and help-desk impact.
Verification
Read the effective default-domain policy.
Get-ADDefaultDomainPasswordPolicy | Format-ListRollback
Restore every value recorded from the baseline. Do not change only one interdependent lockout value.
Official references
See Netcloud24 Canada for managed Windows VPS and RDS CAL services.
