To enable remote access account lockout Set the MaxDenials entry in the registry to 1 or greater. MaxDenials is the maximum number of failed attempts before the account is locked out. By default, MaxDenials is set to 0, which means that remote access account lockout is disabled. To modify the amount of time before the failed attempts counter is reset Set the ResetTime (mins) entry in the registry to the required number of minutes. By default, ResetTime (mins) is set to 0xb40, or 2,880 minutes (48 hours). To manually reset a user account that has been locked out before the failed attempts counter is automatically reset Delete the following registry entry that corresponds to the account name: user’s name:user name When the lockout count for a user account is reset to due to either a successful authentication 0 or an automatic reset, the registry subkey for the user account is deleted. NPS CRL Check Registry Settings You can use the following registry settings to change the way Network Policy Server (NPS) performs certificate revocation list (CRL) checks when EAP-TLS is used. Caution Incorrectly editing the registry can severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. All of the listed registry settings can be configured on NPS servers with the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13 Important All of the following registry settings must be added as a DWORD type and have the valid values of 0 or 1.
To enable remote access account lockout Set the MaxDenials entry in the registry to 1 or greater. MaxDenials is the maximum number of failed attempts before the account is locked out. By default, MaxDenials is set to 0, which means that remote access account lockout is disabled. To modify the amount of time before the failed attempts counter is reset Set the ResetTime (mins) entry in the registry to the required number of minutes. By default, ResetTime (mins) is set to 0xb40, or 2,880 minutes (48 hours). To manually reset a user account that has been locked out before the failed attempts counter is automatically reset Delete the following registry entry that corresponds to the user’s account name: name:user name When the lockout count for a user account is reset to 0 due to either a successful authentication or an automatic reset, the registry subkey for the user account is deleted. NPS CRL Check Registry Settings You can use the following registry settings to change the way Network Policy Server (NPS) performs certificate revocation list (CRL) checks when EAP-TLS is used. Caution Incorrectly editing the registry can severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. All of the listed registry settings can be configured on NPS servers with the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13 Important All of the following registry settings must be added as a DWORD type and have the valid values of 0 or 1.
Windows%20Server%202012%20R2%20Network%20Policy%20Server%20Technical%20Reference.docx