This PowerShell script disables the account lockout policy on Windows and Windows Server machines, which prevents the RDP server from being inaccessible when encountering internet bruteforcers. Fixes error: "As a security precaution, the user account has been locked because there were too many logon attempts or password change attempts."

lockoutfix.ps1

# PowerShell (as admin) one-liner:
# irm datawagon.com/fixlockout | iex
#
# Account Lockout Fix Utility (PowerShell)
# 
# Copyright (C) 2024 DataWagon LLC
# 
# Permission is hereby granted, free of charge, to any person obtaining a copy of
# this software and associated documentation files (the "Software"), to deal in
# the Software without restriction, including without limitation the rights to
# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
# of the Software, and to permit persons to whom the Software is furnished to do
# so, subject to the following conditions:
# 
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
# 
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.


Write-Host "======================================================="
Write-Host "Account Lockout Fix Utility"
Write-Host "Copyright (C) DataWagon LLC 2024 - www.datawagon.com"
Write-Host "======================================================="
Write-Host ""

$isAdmin = [bool]([Security.Principal.WindowsIdentity]::GetCurrent().Groups -match 'S-1-5-32-544')
if (-not $isAdmin) {
    Write-Error "Error: You must run this script as an Administrator."
    return
}


$securityExportPath = "C:\temp_securitypolicy.inf"
$securityExportPatchedPath = "C:\temp_securitypolicy_patched.inf"

secedit /export /cfg $securityExportPath *> $null

$securityExportContent = Get-Content -Path $securityExportPath
$securityExportPatchedContent = $securityExportContent | ForEach-Object {
    if ($_ -match "^LockoutBadCount") {
            "LockoutBadCount = 0"
       } elseif ($_ -match "^(ResetLockoutCount|LockoutDuration|AllowAdministratorLockout)") {
       } else {
            $_
       }
}

$securityExportPatchedContent | Set-Content -Path $securityExportPatchedPath

secedit /configure /db secedit.sdb /cfg $securityExportPatchedPath /quiet *> $null
Write-Output "Configuration process completed with exit code $LASTEXITCODE."

Remove-Item $securityExportPath
Remove-Item $securityExportPatchedPath

return