I have a few computers outside the network, not allowed to have the PS AD module installed.
All I want to do is use Powershell to report some of the account lockout settings, specifically the lockout threshold, lockout duration, and whether this machine is locked out or not.
All I have found during my searches is info using the Active directory PS module. Also, other references dealing with remoteAccess. Neither of which fit my need.
I have also looked for registry keys related to the 'local' lockout settings but have not found anything (E.g. only refs to remoteaccess maxDenial; not the local setting).
Other than firing up gpedit and viewing the local policy, I was hoping there would be a way to use Powershell to simply report the current local settings.
Anyway help/pointers/knowledge would be greatly appreciated.
The discovery of this info, from 'net accounts,' ultimately worked for me, and I was able to write a script that quickly displayed the Lockout policy info. Here is the output from 'net accounts':
PS C:\Users\Siduser> net accounts
Force user logoff how long after time expires?: 0
Minimum password age (days): 1
Maximum password age (days): 60
Minimum password length: 14
Length of password history maintained: 24
Lockout threshold: 3
Lockout duration (minutes): 15
Lockout observation window (minutes): 15
Computer role: WORKSTATION
The command completed successfully.
This code snippet was created to get the info into a variable:
$lockoutObj = net accounts | Select-string threshold
$lockoutStr = $lockoutObj.ToString()
$lockoutStr -match '\d{1,3}' | out-null
$lockoutStr -match 'Never' | out-null
$LO_threshold = $matches[0]
PS C:\Users\Siduser> echo $LO_threshold
3
If you need to set the lockout threshold use this command (elevated priv. needed):
PS C:\Users\Siduser> net accounts /lockoutthreshold:10
The command completed successfully
PS C:\Users\Siduser> net accounts
Force user logoff how long after time expires?: 0
Minimum password age (days): 1
Maximum password age (days): 60
Minimum password length: 14
Length of password history maintained: 24
Lockout threshold: 10
Lockout duration (minutes): 15
Lockout observation window (minutes): 15
Computer role: WORKSTATION
The command completed successfully.