If you use a policy to enforce Internet password lockout settings, the settings in the policy document override those in the Configuration Settings document.

Field	Action
Enforce Internet password lockout	(Required) When enabled, the server enforces Internet password lockout. This option must be enabled for any Internet password lockout functionality to work. If you set this option to yes, the settings described below appear.
Log Settings	If 'Lockouts' is enabled, events in which a user has been locked out and events in which a user tries to authenticate but is already locked out are logged. If 'Failures' is enabled, any failed authentication attempt is logged. The IP address and user name of the client trying to authenticate are also included in the log.
Default Max Tries Allowed	Maximum number of password attempts allowed before a lockout occurs. When set to 0, unlimited password attempts are allowed.
Default Lockout Expiration	Period of time for which a lockout is enforced. You can set this time to be in minutes, hours, or days. After this time period, a user account is automatically unlocked the next time the user tries to authenticate. When set to 0, automatic lock is disabled.
Default Maximum Tries Interval	The period of time that must elapse before a successful authentication clears any previous failure attempts. You can set this time to be in minutes, hours, or days. Specify a longer interval for greater security. When set to 0, failed password attempts are cleared every time a successful authentication occurs.

Glossary