How to set 'Account lockout duration' with an intune device policy

Question

Good morning

For the Security Recommendation "Set 'Account lockout duration' to 15 minutes or more" I want to deploy this setting with the value "15" as a device configuration policy. I know I can set the LockoutPolicy with a OMA-URI "./Device/Vendor/MSFT/Policy/Config/DeviceLock/AccountLockoutPolicy" but how can I set the specific account lockout duration setting?

Thanks in advance and have a good day!

Answer 1

I finally found the correct Value string for the OMA-URI on https://github.com/microsoft/osconfig/blob/main/security/SecurityBaseline_WindowsServer_2025-2409.csv (and there are a lot of other good settings there also) as the page at https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-devicelock is still missing this information as of December 2024. Note that you need Windows 11 24H2 / Server 2025 or later for this setting to actually take effect. You can validate the settings changes with the command "net accounts".

You would set it as follows in Intune as a Custom OMA-URI (the below example uses lockout values of 15 minute duration and 10 invalid attempts):

Name: <Whatever you want to use here - I used DeviceLockAccountLockoutPolicy>
Description: <Whatever you want to use here - I referenced the GitHub URL above where I found the setting in the correct format plus some other notes>
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/DeviceLock/AccountLockoutPolicy
Data type: String
Value (just paste this as-is - it is one long line unlike a MultiString - even if it does not look like it in the Value box in Intune):
AccountLockoutDuration:15, AccountLockoutThreshold:10, ResetAccountLockoutCounterAfter:15

Answer 2

@Michèle Merlo, Thanks for posting in Q&A.

From your description, I know you want to set specific account lockout duration setting.

Based on the official document, the AccountLockoutPolicy setting is only available for Device, therefore, when you create a custom policy, and configure all settings, you should assign the policy to device group, then the device will apply the policy and also every user login on to this device will also be affected by this policy. Therefore, currently, there is no such way to set the specific account lockout duration setting. And it is suggested that you create the policy and assign it to device group and make it to apply all users.

https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-devicelock#accountlockoutpolicy

Thanks for your kind understanding.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

The Microsoft page says that the OMA-URI is a String, and after setting the settings through local group policy and exporting the list I got this:

Policy,Security Setting

Account lockout duration,0

Account lockout threshold,5 invalid logon attempts

Reset account lockout counter after,15 minutes

(I exported it as a comma delaminated .txt)
It's possible that the String value should be something like that? But I feel like there's extra data in that, like "minutes" or "invalid logon attempts"
trying things via Intune, so far no dice...

Also haven't found an AMDX to import...
And checking regedit for "Accountlockoutduration" didn't get me anywhere
pushing this via Intune in the String:

Accountlockoutduration,0

Accountlockoutthreshold,5

Resetaccountlockoutcounterafter,15

Also returned an error...