Can't locate Account Lockout Policy

[Nausing]

Hi all,

 

All users get locked out after 3 failed logon attempts. I want to change this number to hopefully reduce the number of students locking themselves out.

 

I can't locate the setting in the GPOs.

 

Does anyone have a method to search all GPOs for this setting?

 

Location

GPO_name\Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy

 

Thanks.

Theo

[DJ-1701]

If you use the Group Policy Management Console, you can run a Group Policy Modeling or a Group Policy Results request to find out which policy is applying the setting.

 

Generally this is contained in the Default Domain Policy though.

[Davit2005]

Maybe set at the Default Domain Policy unless you have anything special set.

[Steve21]

Did you check in ADAC if it's 2012? Might not be a GPO

 

Steve

[Nausing]

Thanks all for your replies however it seems it isn't listed in any GPO...

The policy has been in place for many years before we introduced 2012 DCs so it wouldn't be in there..

 

Anywhere else it could be?

[Davit2005]

Thanks all for your replies however it seems it isn't listed in any GPO...

The policy has been in place for many years before we introduced 2012 DCs so it wouldn't be in there..

 

Anywhere else it could be?

 

Check your Default Domain Policy. Even though they maybe new DC's they will keep the same policies if the Domain Controllers were upgraded.

[Nausing]

Check your Default Domain Policy. Even though they maybe new DC's they will keep the same policies if the Domain Controllers were upgraded.

 

I've checked it.. nothing in there! Mystery...

[Norphy]

You may have fine grained password policies in place.

 

Open ADSI Edit, go to the default naming context, CN=System -->CN=Password Settings Container

 

 

If there is something there, get its properties and go to the msDS-PSOAppliesTo property. Under there, there should be a DN to a group listed.

 

[Nausing]

You may have fine grained password policies in place.

 

Open ADSI Edit, go to the default naming context, CN=System -->CN=Password Settings Container

 

[ATTACH=CONFIG]38960[/ATTACH]

 

If there is something there, get its properties and go to the msDS-PSOAppliesTo property. Under there, there should be a DN to a group listed.

 

[ATTACH=CONFIG]38961[/ATTACH]

 

 

Thanks for the info.

 

There is a CN=Directorate PSO in that container but the msDS-PSOAppliesTo is not set. I can only assume this is for Direcorate and not all users whoever set it up.