r/sysadmin•
porkins99

Different Account Lockout Thresholds by Machine Groups

Is there a way to have different Account Lockout Thresholds assigned to different groups of Windows machines on a domain?

We have a domain. Normally threshold is set to 3. I want to grant the Remote Desktop Services servers to have 7 instead. So I want Domain Users to be given only 3 attempts on the Windows workstations (logging into the domain), but have 7 attempts when logging into RDS servers (still logging into their same domain accounts).

Is this possible? I have already tried to have a main GPO that set s threshold to 3 everywhere, and then I have another GPO that sets it to 7 on the RDS servers only (by way of the OU they are contained within).

Posted Mar 9, 2021, 3:39 PM UTC

14
Loading comments…