is it best practice to use account lockout policy

windows server 2008 r2 (will moving 2012 r2)

since implementing account lockout policy 2 days ago, we've been bombarded calls unlock accounts. , after few minutes, same users accounts locked again.

my question, since using strong password policy (8 chars min, 90 days max expire), @ day , age still best practice rely on account lockout policy? keeping in mind above flood of calls.

since implementing account lockout policy 2 days ago, we've been bombarded calls unlock accounts. , after few minutes, same users accounts locked again.

my question, since using strong password policy (8 chars min, 90 days max expire), @ day , age still best practice rely on account lockout policy? keeping in mind above flood of calls.

account lockout considered un-necessary if have implemented strong password complexity/history policy.

there many discussions on topic of password/passphrase "strength", , it's important consider various factors involved, and, how affect organisation's view of "security".

i 8 chars not strong. should consider if password aging/expiry useful control @ all.

since forum related group policy, and, password/security quite separate topic, should consider ds forum or security forum, or separate research or consulting services, broad understanding of things consider particular requirements/scenario.

other considerations include security standards can useful reading understand nature of topic (e.g. pci dss, hipaa, fips, etc)

---

don
(please take moment "vote helpful" and/or "mark answer", applicable.
helps community, keeps forums tidy, , recognises useful contributions. thanks!)

Windows Server  >  Group Policy