MacOS – Can an ‘incorrect password lockout’ be set

macospasswordSecurity

I administer seven Macs running a range of OS X 10.10 to macOS 10.13. The machine I use to administer them is running OS X 10.10.

All of the users are Standard accounts, with one Admin account which I use to administer the computers.

Is there a way to set an incorrect password lock out, which will only let you try more passwords if, a set time is elapsed, or the Admin user grants access again?

I would like to use the lockout as an additional layer of security from someone trying to brute force their way into a remote desktop session with a machine when the machine is on a public network (eg. hotel / airport etc).

Best Answer

It turns out that you can use a Terminal command to achieve this. Note that parts of this command are deprecated, but I tested it on macOS 10.13.3 and everything seems to work.

  1. On the device that has the account you want to set a lock on, log into the administrator account.
  2. Open Terminal and enter the following command; pwpolicy -u testuser -setpolicy "maxFailedLoginAttempts=1". Assume that testuser is the short name of the user you want to apply the lockout settings to, and 1 is the number of failed attempts required to trigger the account lock.
  3. Restart the device to ensure that the changes take affect.

If an account is locked, you can log into the administrator account again and unlock the standard account using the following command; pwpolicy -u testuser -enableuser.

Update: I was able to test this with remote connections, and your device will not allow remote authentication with a locked account.