Lockout policy

What happens after repeated failed sign-ins, for one account and for one address.

Set on Lockout Policy in your console. Two protections run side by side: one counts failures against an account, the other against an address.

The Lockout Policy page: failed attempts before lockout, the lockout type and duration, and address blocking below. — Lockout Policy.

Account lockout#

Setting	Default	Meaning
Enabled	On
Failures before lockout	3	Wrong passwords in a row before the account is locked.
Lockout type	Temporary	Temporary locks expire by themselves. A permanent lock stays until a member of your team lifts it.
Lockout duration	15 minutes	How long a temporary lock lasts.
Failure window	5 minutes	Failures further apart than this are not counted together.

A locked user is told how long to wait. A correct password during the lock is still refused: that is what makes the lock worth anything against someone guessing.

Address blocking#

Setting	Default	Meaning
Enabled	On
Failures before a block	25	Failed sign-ins from one address, across any accounts.
Block duration	15 minutes
Failure window	5 minutes

This is what stops someone trying one common password against many accounts, which account lockout alone never notices.

Blocks are listed on IP Blocks, with the address, the number of failures, the reason and the expiry. You can lift one, or several at once.

The IP Blocks page: one address blocked after 25 failures, with the time remaining and an Unblock button. — IP Blocks. One address, blocked after repeated failures, with the time left.

An office behind one address

Several people mistyping passwords behind the same NAT address can add up to one block that then stops the whole office. If "it worked yesterday and now nobody here can sign in", check IP Blocks before anything else.

Unlocking someone#

	Who can	Where
Unlock an account	Helpdesk and above	Your console.
Lift an address block	Helpdesk and above	IP Blocks.

Being told#

The Account locked out alert fires when an account is locked. See Alerts and cases.

Something missing or wrong on this page? Tell us and we will fix it.