Registry Settings to lockout too many Remote Desktop login attempts?

I need settings to do two things - via Registry or otherwise. (This is for a Windows 10 Pro PC, acting as my "server").

1. Registry settings to lockout Account after specified number of login attempts via Remote Desktop, say 5.

2. Local logon should not be locked. i.e. If you keyboard is plugged directly to the PC, you should be able to login to the account.

Last time this happened I had to resort to Linux to unlock the PC as the account remained locked.

UPDATE.the answer to part 1) I already know, because that's how i configured the PC.

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout

1 Answer

You cannot specify separate lockout settings for access via RDP vs. the physical console. Account lockout settings apply to the account, not the logon method.

Perhaps a way to achieve your goal would be to have a second admin user account configured on the machine that is denied access through Remote Desktop (thus mitigating the possibility of getting locked out) and use that account to unlock the first when required.

Alternate Solution

If you have the Pro or Enterprise version of Windows, you can configure the account lockout duration such that locked out accounts are automatically unlocked after a specified amount of time:

1. In Start search and run the Local Security Policy app.

2. Navigate to Account Policies/Account Lockout Policy.

3. Set the Account lockout threshold setting to a non-zero value (otherwise you cannot configure the other settings in this branch).
4. Configure the Account lockout duration setting as desired.