To make failed sign-in attempts lock the built-in Windows Administrator account, configure the separate AllowAdministratorLockout setting in Microsoft’s DeviceLock Policy CSP. The standard Account lockout threshold policy does not include that account. Check each device’s Windows 11 version, update level, and edition before planning deployment; Microsoft documents support only for specified Windows 11 releases and editions.
Why the usual account lockout threshold is not enough
Windows’ Account lockout threshold policy sets how many failed sign-in attempts trigger a lockout, along with related duration and counter-reset behavior. But Microsoft explicitly excludes the built-in Administrator account from that policy: “The built-in Administrator account, however, whilst a highly privileged account, has a different risk profile and is excluded from this policy.” Microsoft’s Account lockout threshold policy reference
As an Amazon Associate I earn from qualifying purchases.
For the built-in account, Microsoft documents the separate DeviceLock CSP setting AllowAdministratorLockout. It determines whether that account is subject to account lockout policy. The related AccountLockoutPolicy CSP setting configures the threshold, lockout duration, and time before the failed-attempt counter resets; it is not a substitute for the separate administrator inclusion setting. Microsoft DeviceLock Policy CSP documentation
Check whether the Windows 11 devices are supported
Microsoft lists the DeviceLock CSP account lockout settings as device-scoped and documents support for these Windows 11 editions and releases:
#1 Best Overall
- Windows 11 Pro, Enterprise, Education, and IoT Enterprise, version 22H2 with KB5053657 (build 22621.5126) or later.
- Windows 11 Pro, Enterprise, Education, and IoT Enterprise, version 24H2 (build 26100) or later.
Verify the edition, version, and installed updates on every target device before designing a rollout. These stated requirements concern the DeviceLock CSP settings; do not assume that a Windows LAPS prerequisite is also a prerequisite for account lockout policy.
Choose the lockout behavior
Decide whether to include the built-in account
Use AllowAdministratorLockout to determine whether failed attempts can lock out the built-in Administrator account. This is a distinct decision from setting the attempt threshold. Microsoft documents the setting in the DeviceLock Policy CSP.
Set threshold, duration, and counter reset
AccountLockoutPolicy supports a failed-attempt threshold from 0 to 999; a threshold of 0 means the account is never locked out. It can also specify lockout duration and the interval after which the failed-attempt counter resets. A duration of 0 means an administrator must explicitly unlock the account. Microsoft documents dependency constraints between duration and reset interval when a threshold is configured, so check the CSP specification when selecting values rather than treating the fields as independent.
Free tools Windows power users keep installed
One-click scans. No signup required.
Microsoft’s Account lockout threshold guidance gives 10 invalid sign-in attempts as a possible starting guideline. It is not a universal rule and is not a special recommendation for the built-in Administrator account. The cited policy page does not state a publication year for that figure. Microsoft Account lockout threshold guidance
Rank #3
Plan for security and recovery trade-offs
Lockout can impede repeated password guessing, but an attacker who can reach the account may deliberately cause failed attempts and lock it, creating a denial-of-service problem. A stricter configuration therefore needs an operational plan for legitimate users or administrators who become locked out. Microsoft advises organizations to weigh the setting against their threat and operational context and maintain a process for unlocking accounts.
- Consider whether the protection against repeated guessing justifies the risk of an attacker triggering lockout.
- Set duration and counter-reset values with the account’s recovery needs in mind.
- Ensure administrators know how an account is unlocked, especially if the configured duration is 0 and an administrator must unlock it explicitly.
What Intune can and cannot be said to do here
Microsoft documents AllowAdministratorLockout and AccountLockoutPolicy as DeviceLock CSP settings, but the cited documentation does not provide a complete, setting-specific Intune custom-policy walkthrough for AllowAdministratorLockout. Avoid assuming a particular portal path or deployment workflow based on that documentation alone. Use the CSP documentation to confirm the setting and applicability, then validate the supported deployment method for your environment before rollout.
Use Windows LAPS as a separate administrator-password control
Windows LAPS can help manage local administrator passwords through password requirements, password backup, and scheduled rotation. Intune’s endpoint security Account protection policies can configure those LAPS capabilities, including backup to Active Directory or Microsoft Entra. Intune LAPS manages one administrator account per device; if no account name is specified, it manages the built-in Administrator account. These features manage the password lifecycle, not whether failed sign-in attempts lock the account.
Microsoft’s LAPS overview lists Intune Plan 1 and Microsoft Entra ID Free among the requirements for the described Intune LAPS support, gives Windows prerequisites, and says workplace-joined devices are not supported for Intune LAPS. Those are LAPS-specific applicability details, not requirements for the DeviceLock CSP lockout settings. See Microsoft’s Windows LAPS with Microsoft Intune overview and policy deployment documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
