Windows Server 2025 lockout after 10 failed logins

A fresh Windows Server 2025 with a public address gets its first password guesses on Remote Desktop within minutes. That has always been true. What changed with 2025 is the answer: after 10 failed attempts, Windows now locks the account, including the built-in Administrator. The bots do not get in, but neither do you.

We measured it on our own images, changed the default on every Windows image we offer, and kept other protections in its place. Here is what we found and how to check or change it on your own server.

1. What we measured

We started a new server from each image and read the policy as soon as Windows finished its first boot:

C:\> net accounts | findstr /c:"Lockout threshold"
Lockout threshold:                                    10

This comes from a change Microsoft shipped in October 2022 (KB5020282). Until then, the built-in Administrator could never be locked out. A new policy, Allow Administrator account lockout, made it possible, with recommended values of 10/10/10: ten failures within ten minutes lock the account for ten minutes. On new installations of recent Windows versions, these settings are applied at setup, and Windows Server 2025 is one of them. Our 2019 image does not have them.

2. Why it hurts on a server exposed to the Internet

Lockout counts failures per account, not per source. On a server with RDP open to the world, the failures come from scanners that try Administrator with lists of common passwords, around the clock. Ten of them in ten minutes is a quiet afternoon. Each time, the account is locked for ten minutes, for everyone.

From your side, Remote Desktop answers that the account has been locked because there were too many login attempts, with the right password typed correctly. For a trading server that has to stay reachable, or anyone who needs to fix something now, that is an outage you did not cause.

3. What we changed

Every Windows image we offer now sets the threshold to 0 (Never) at first boot, with the MetaTrader images included:

C:\> net accounts /lockoutthreshold:0
The command completed successfully.

C:\> net accounts | findstr /c:"Lockout threshold"
Lockout threshold:                                    Never

Turning a protection off is only reasonable if something else does its job. Here, two things do:

• The password. The one we generate at order time is 16 random letters and digits, about 95 bits. Guessing it over RDP is not a realistic attack, with or without lockout. Lockout mainly protects weak passwords; if you set your own, make it long.
• Who can reach RDP at all. The real fix is to stop strangers from reaching port 3389. A cloud firewall that only lets your own addresses through removes both the guesses and the lockouts, and it is included with every machine.

Security benchmarks such as CIS recommend a threshold of 5 or fewer. That advice assumes a server inside a company network, where failures come from users who mistyped. On a VPS facing the Internet, it hands the bots a switch to lock you out. If you prefer to keep lockout, restrict RDP first, then turn it back on.

4. Check and change it on your server

In an administrator command prompt or PowerShell:

net accounts

The three lines that matter are Lockout threshold, Lockout duration and Lockout observation window. To disable lockout:

net accounts /lockoutthreshold:0

To keep it, with values that suit a server you have already restricted:

net accounts /lockoutthreshold:5 /lockoutduration:15 /lockoutwindow:15

The same settings live in secpol.msc, under Account Policies > Account Lockout Policy, next to Allow Administrator account lockout. A domain policy, if your server joins a domain, overrides the local values.

5. Already locked out?

The lockout only applies to network logons such as RDP. Logging in on the console still works during the lockout period, as Microsoft's own note confirms. Open your server's console from the client area, sign in as Administrator, and either wait for the lockout duration to pass or clear it by hand: open lusrmgr.msc, then Users, the account's properties, and untick Account is locked out.

Then fix the cause, otherwise the next wave of guesses locks it again: firewall rule, or threshold set to 0, as above.

6. See who is knocking

Failed logons are event 4625 in the Security log, lockouts are event 4740. To count the failures of the last hour:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-1)} |
    Measure-Object

On a server with RDP open to everyone, the count is rarely zero, even when nobody knows the server exists. Behind a firewall that only admits your address, it stays at zero, and that is the setup we recommend. To restrict RDP from Windows itself rather than from the console (replace the address with yours):

Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 203.0.113.10

Running MetaTrader or another tool that must stay up around the clock? Our guide to choosing a trading VPS covers the rest of the checklist.