Windows 2000 Domain Account Lockout Process

This article explains how Microsoft Windows 2000 Active Directory processes domain user account lockouts when failed logon attempts exceed configured security thresholds. It covers the core policy parameters governing lockouts, the step-by-step authentication evaluation sequence across Domain Controllers, the central role of the Primary Domain Controller (PDC) Emulator Flexible Single Master Operation (FSMO) role, and the mechanism for clearing lockout states.

Account Lockout Policy Parameters

In Windows 2000 Active Directory, account lockout behavior is enforced globally at the domain level via Group Policy (typically within the Default Domain Policy). Three core attributes govern the process:

  • Account lockout threshold: The number of consecutive failed logon attempts (using invalid passwords) allowed before the account is disabled. Setting this value to 0 disables lockout entirely.
  • Account lockout duration: The length of time (in minutes) an account remains inaccessible to the user before the system automatically unlocks it. If set to 0, the account remains locked until an administrator manually clears the state.
  • Reset account lockout counter after: The window of time (in minutes) that must pass after a failed logon attempt before the counter of bad attempts resets to zero. This value must be less than or equal to the lockout duration.

Authentication and the Counter Mechanism

When a user attempts to authenticate in a Windows 2000 domain using Kerberos v5 or NTLM, the request is directed to an available Domain Controller (DC).

  1. Credential Validation: The authenticating DC compares the submitted credentials with its local Active Directory replica.
  2. Bad Password Tracking: If the password is incorrect, the DC increments the user object’s badPwdCount attribute. Unlike most Active Directory attributes, badPwdCount is maintained locally on each DC and is not replicated across the domain to prevent excessive replication traffic.
  3. Forwarding to the PDC Emulator: Before failing the request, the local DC checks with the PDC Emulator FSMO role. This ensures that the user is not authenticating with an updated password that has not yet replicated to the local DC. If the PDC Emulator also fails the authentication, it increments its own badPwdCount for that user.

Triggering the Account Lockout

A lockout occurs when the recorded failed attempts equal or exceed the defined lockoutThreshold:

  1. Evaluating the Threshold: Once the authenticating DC or the PDC Emulator detects that the badPwdCount meets the threshold limit, it triggers the lockout mechanism.
  2. Updating lockoutTime: The DC updates the user object's lockoutTime attribute. A value of 0 indicates the account is not locked; any non-zero value represents the timestamp (in UTC) when the account was locked.
  3. Urgent Replication: Because an account lockout is a security-sensitive event, the change does not wait for the standard inter-DC replication schedule. The DC flags the update for urgent replication, immediately pushing the updated lockoutTime to the PDC Emulator, which then propagates it rapidly throughout the domain.
  4. Subsequent Logon Rejection: Any DC that possesses the updated lockoutTime attribute immediately rejects future authentication requests for that account with a status indicating that the account is currently locked out.

Resetting and Unlocking Accounts

An account in Windows 2000 returns to an active state through one of two methods:

  • Automatic Expiration: If the Account lockout duration is set to a non-zero value, DCs calculate whether the duration period has passed relative to the lockoutTime timestamp during subsequent logon attempts. Once the duration expires, the system permits authentication if valid credentials are provided, and lockoutTime is cleared.
  • Manual Intervention: An administrator can open the Active Directory Users and Computers MMC snap-in, access the properties of the user account, and uncheck the "Account is locked out" box. This action resets the lockoutTime attribute to 0 and zeroes out the badPwdCount attribute across the domain.