How to Check Account Lockout Policy on Windows Systems Using Saner

Modified on Wed, 24 Sep at 5:21 PM

Overview
This article explains how to check the Account Lockout Policy on Windows systems using Saner’s Endpoint Management module, schedule query execution, and take appropriate actions based on the results.

Prerequisites

Before beginning, ensure the following:

You have access to Saner with permissions to use Endpoint Management.
Agents are installed and active on the target Windows systems.

Steps to Check Account Lockout Policy

Step 1: Log in and Select Account

Log in to Saner.
Choose the Organization and corresponding Account where you want to check the account lockout policy.

Step 2: Access Endpoint Management

Select the Endpoint Management module.

Step 3: Open Checks

Click on Checks in the top-right corner.

Step 4: Select Windows Security Checks

From the drop-down menu, select Windows → System Security.

Step 5: Select Account Lockout Policy

Scroll down to see highlighted checks in green.
Select Account Lockout Policy.

Step 6: Schedule Query Execution

Click Trigger to schedule query execution for the agent.
Fill in the Query Trigger Settings:
- Query run count time in seconds.
- Frequency in minutes to run the query.
- Query Trigger Time Frame in the Schedule options pane.
Click Update.

Step 7: Select Scope

Click Scope to choose the target scope for the query.

Step 8: Submit Query

Click Submit to send the query to the agent.

Step 9: View Results

In the Result Pane, review details such as:
- lockout_duration
- lockout_observation_window
- lockout_threshold
- Hosts and Device names
Results can be downloaded in CSV format.

Step 10: Take Actions Based on Results

Possible actions are listed in the bottom pane.
Click the desired action to be redirected to the Create Response page.
All responses created for the selected check can be viewed in Created Actions.

Note:
Following these steps allows administrators to monitor account lockout policies across Windows systems.