Account lockout: why it locks, and what is usually still trying

After a set number of wrong passwords in a row, the account locks for a set time, so a guesser gets a handful of tries and not a million. Most lockouts are not a guesser: they are an old password still saved on a phone, a mapped drive or a scheduled task, trying again every few minutes.

Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.

What it is for

A user changed their password at 09:00, was locked out by 09:20, was unlocked, and was locked out again by 09:40. Nobody is attacking them. Their phone's mail app has the old password and is knocking on the door every five minutes. Unlocking without finding the phone is a ticket that reopens every twenty minutes all day.

How to think about it

Verify identity, because an unlock is a reset's little brother. Read the lockout time and the policy: how many attempts, how long the lock. Ask what changed: a new password today is the answer nine times in ten. Ask what else signs in as them: phone, tablet, a second laptop, a mapped drive, a saved credential. Unlock, then fix the thing that was still trying, and only then call it done.

Worked example

Policy: 5 wrong attempts locks for 15 min. Locked at 08:04 → unlocks itself at 08:19

The clock. Fifteen minutes from the lock. Or the desk unlocks it now, after verification.

What changed: password changed this morning at 07:50

The new password is on the laptop. The old one is somewhere else.

Phone mail app: still holding the old password, retrying every 5 min

The guesser. It made five attempts in fourteen minutes and locked the account.

Unlock, update the phone, watch for 30 min: no re-lock

The fix is the phone, and 'no re-lock for half an hour' is the verification.

Your turn

An account locked at 09:50 with a 30-minute lockout. Write when it unlocks on its own.

Locked 09:50, 30 min → unlocks at

The trap

Unlocking and closing. The thing that locked it is still trying, and it will lock it again before the user gets back to their desk, and the second ticket has your name on the first one.

Practise account lockout on HoneA question on it now, a coding challenge where there is one, and it is remembered for review. Free, no email needed.