Unsuccessful Logon Attempts

Pick a threshold and a lockout behavior, write both down, and configure them.

Objective [a] wants the means defined: after a set number of consecutive failures the account locks, either for a fixed period or until an administrator releases it. Objective [b] wants that exact configuration present in the system. The number is yours to choose. There is no mandated value, and fewer permitted attempts means higher security.

Prefer a temporary lockout with automatic release.

A lockout that releases after a delay blunts password guessing without turning failed logons into a denial of service or a standing help desk queue. The guide's own example pairs a three-attempt lockout with a thirty-minute automatic release and an administrator override. Reserve permanent lockout for accounts where the risk justifies the friction.

Apply the limit at every logon surface.

Workstations, VPN gateways, and your identity provider, the service that checks user sign-ins, each present a logon, and each needs the defined limit. Windows account lockout policy, Microsoft Entra ID smart lockout, and the failure limit on your VPN are all implementations of the same defined means. List each surface and its setting so [b] is demonstrable everywhere someone can type a password.