部署 Windows Server来管理计算机和其他策略的企业至关重要。管理服务器的好处是您不必亲身在它周围。您始终可以从任何地方远程登录到服务器。这意味着其他人也可以尝试登录。在这篇文章中，我们将分享如何使用注册表方法在Windows Server中配置^{(Windows Server)}远程访问客户端帐户锁定。^{(Remote Access Client Account Lockout)}

配置远程访问客户端帐户锁定^{(Remote Access Client Account Lockout)}

如果您想知道为什么设置了锁定设置，那么它是为了确保阻止攻击者。设计完成后，它不仅可以确保阻止进行猜测的攻击者，还可以阻止执行字典攻击的攻击者。不记得确切密码的有效用户可能会发生这种情况。锁定确保用户在一段时间内无法尝试攻击，使工作服的安全性更好。

但是，这也意味着它可以锁定合法用户，这可能会让人烦恼。在这篇文章中，我们还将展示如何手动解锁远程访问客户端。

根据您用于身份验证的内容，相应地配置注册表设置。如果您使用Microsoft Windows 身份验证，则在^{(Microsoft Windows Authentication)}远程访问服务器^{(Remote Access Server)}上配置注册表。但如果您为RAS使用^(RAS)RADIUS，则在Internet Authentication Server或IAS上配置它。

以下是我们将配置的内容列表：

• ^(Number)锁定前的失败尝试次数
• 锁定计数器重置的时间

确保^(Make)在进行任何更改之前备份注册表。

启用远程访问客户端帐户锁定^{(Remote Access Client Account Lockout)}

通过在运行^(Run)提示中键入Regedit打开注册表编辑器^{(Registry Editor)}，然后按Enter键。找到^(Locate)并单击以下注册表项：

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout

找到并双击MaxDenials值。将该值设置为大于零的任何值，这也意味着它是失败尝试的次数。因此，如果您设置为两次，第三次尝试将导致锁定。点击确定^{(Click OK)}确认

接下来，双击十六进制的ResetTime (mins)值。默认值设置为两天，因此请确保根据贵公司遵循的政策进行设置。

单击确定，然后退出注册表编辑器^{(Registry Editor)}。

注册表编辑以手动解锁远程访问客户端^{(Access Client)}

假设您有一个锁定的帐户，并且您需要解锁，因为锁定超时时间很长。每次用户被锁定时，都会以DomainName:UserName的格式向其中输入一个条目。要解除锁定，您需要将其删除。

• 打开注册表编辑器并导航到以下路径。

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout

• 找到 Domain Name:User Name值，然后删除该条目。
• 退出注册表编辑器^{(Quit Registry Editor)}并检查用户帐户是否能够使用正确的凭据登录。

就是这样。在进行任何更改之前，请务必备份注册表设置。

我希望这篇文章能让您清楚地了解如何配置锁定并解除对远程客户端的阻止。

Configure Remote Access Client Account Lockout in Windows Server

Businesses that dеploy Windows Server tо manage computers and other policies are crucial.  The nice part аbout managing ѕervers is that you don’t have to be physicallу around it. You can always remotely log in to the server from anуwhere. That means somebody else can also try to login as well.  In this post, we will share how you can configure Remote Access Client Account Lockout in Windows Server using the Registry method.

Configure Remote Access Client Account Lockout

If you are wondering why there is a lockout setup in place, then it is to make sure to keep attackers at bay. Once you design, it will not only make sure to keep attackers who do guesswork but also those who perform a dictionary attack. It can happen to a valid user who doesn’t remember the exact password. The lockout makes sure that the user will not be able to try to attack for some period of time, making the overalls security better.

However, it also means that it can lock out legitimate users, which can annoy. In this post, we will also show how you can manually unlock a remote access client.

Depending on what you are using for authentication, configure the registry settings accordingly.  If you are using Microsoft Windows Authentication, then configure the registry on Remote Access Server. But if you are using RADIUS for RAS, then configure it on Internet Authentication Server or IAS.

Here is the list of things we will configure:

• Number of failed attempts before lockout
• The time after which the lockout counter is reset

Make sure to take a backup of the registry before making any changes.

Enable Remote Access Client Account Lockout

Open Registry Editor by typing Regedit in the Run prompt and press the Enter key. Locate and then click the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout

Locate and then double-click the MaxDenials value. Set the value to anything above zero, which will also mean it is the number of failed attempts. So if you set to two, the third attempt will result in a lockout. Click OK to confirm

Next, double-click on the ResetTime (mins) value, which is in hexadecimal. The default value is set for two days, so make sure to put it according to the policy your company follows.

Click OK, and then quit Registry Editor.

Registry Editing to manually unlock a Remote Access Client

Assuming you have a locked account, and you need to unlock because the lockout timeout is pretty long. Every time a user is locked out, an entry is made into it in the format of DomainName:UserName. To remover the lock, you need to delete it.

• Open the Registry  Editor and navigate to the following path.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout

• Find the Domain Name:User Name value, and then delete the entry.
• Quit Registry Editor and check if the user account is able to login with the right credentials.

That’s about it. Always make sure to backup registry settings before you make any changes.

I hope the post gave you clear insight on how you can configure lockout and also unblock a remote client.

Related posts

• 如何在Windows Server & Client Machines启用LDAP签名

• 免费Remote Access software清单Windows 10

• Install Remote Server Administration Tools（RSAT）在Windows 10上

• 如何在 Windows 11 中安装和查看远程服务器管理工​​具 (RSAT)

• 禁用Windows Server的行政份额

• VNC Connect是免费Windows的免费remote control software

• Windows 10 Best免费Remote Desktop software

• Windows 11/10中Remove History Remove History条目

• Fix Remote Desktop在Windows 11/10中找不到computer error

• Windows 11/10中的Create Remote Desktop Connection shortcut

• 您的凭据在Windows 11/10上的Remote Desktop不起作用

• 什么是远程访问木马？预防、检测和清除

• Remote Desktop Services在Windows 10中导致High CPU

• NeoRouter是Zero Configuration Remote Access & VPN Solution

• Remote Desktop不工作或不会Windows 10连接

• Set起来Windows 10 Kodi Remote Control使用Android & iOS devices

• 修复远程桌面不会在Windows 10中Connect

• 修复RPC server在Windows 10中不可用错误

• Connect Android至Windows 10使用Microsoft Remote Desktop

• 如何在Windows Server中删除Roles and Features