Windows 2000 Domain Account Lockout Enforcement

In Microsoft Windows 2000, domain account lockout thresholds are enforced centrally across Active Directory to protect user accounts from brute-force authentication attacks. This mechanism relies on Group Policy settings applied at the domain level, coordinated between authenticating Domain Controllers (DCs) and the Primary Domain Controller (PDC) Emulator role to accurately track failed logon attempts and trigger lockouts in real time.

Group Policy Configuration

Account lockout behavior in Windows 2000 is defined within the Default Domain Policy Group Policy Object (GPO). Because domain accounts are evaluated against a single unified security boundary, these settings can only be set at the root of the domain:

  • Account lockout threshold: Specifies the number of invalid logon attempts permitted before the account is locked (ranging from 1 to 999; 0 disables lockout).
  • Account lockout duration: The number of minutes a locked account remains unavailable before automatically unlocking (or 0, requiring manual administrative unlocking).
  • Reset account lockout counter after: The time window in minutes that must elapse after a bad attempt before the failed logon counter resets to zero.

The Authentication Process and the PDC Emulator

When a client attempts to log on using Kerberos v5 or NTLM, the request is handled by an available Domain Controller. Windows 2000 enforces lockout thresholds through a specialized sequence involving the PDC Emulator FSMO role to prevent replication latency from skewing failed attempt counts:

  1. Local Failure Logging: When an authentication attempt fails due to an incorrect password, the validating DC increments its local badPwdCount attribute for the target user.
  2. PDC Emulator Verification: Because password changes might have occurred recently and not yet replicated, the validating DC immediately forwards the failed authentication request to the PDC Emulator.
  3. Central Counter Increment: If the PDC Emulator also rejects the credential, it increments the user's badPwdCount on its authoritative copy of the directory.
  4. Threshold Evaluation: The PDC Emulator compares the updated counter against the configured Account Lockout Threshold.

Triggering the Lockout

If the total number of consecutive failed attempts reaches the threshold defined in the policy:

  • The PDC Emulator immediately sets the user account's lockoutTime attribute to the current system timestamp.
  • The PDC Emulator flags the account as locked out. Subsequent authentication attempts fail with an error indicating that the account is locked.
  • Urgent replication is triggered for the lockout status, ensuring that all other Domain Controllers in the environment are rapidly notified of the locked state without waiting for standard Active Directory replication intervals.

Account Unlocking and Reset

An account exits the locked state either through administrative action or policy expiration:

  • Time Expiration: If the Account Lockout Duration is set to a non-zero value, an authentication attempt occurring after the elapsed duration calculates that lockoutTime plus the duration has passed. The DC resets the lockout state and allows valid credentials.
  • Counter Reset: If successful authentication occurs before the threshold is breached, or if the time specified in "Reset account lockout counter after" passes between failed attempts, the badPwdCount attribute resets to 0.
  • Manual Intervention: An administrator using Active Directory Users and Computers can clear the lockout by unchecking the "Account is locked out" box on the user's account properties, which resets the lockoutTime attribute to 0.