What Is Account Lockout?

Account lockout is a security control that temporarily blocks sign-in to an account after too many consecutive failed password attempts, so automated guessing becomes impractically slow. In EDGEBIC the default is five failed attempts followed by a fifteen-minute lock, during which even the correct password is refused. It protects accounts without permanently punishing a real person who just mistyped, because the lock clears itself after the window.

EDGEBIC by User Solutions applies lockout automatically during the sign-in flow. This article defines the term and the default policy. For where accounts and their protections are configured, see how EDGEBIC handles users and roles.

How It Works

Every account keeps a running count of consecutive failed sign-in attempts. Each time the wrong password is entered, the count goes up by one. When it reaches the threshold, the account is locked: a lock timestamp is set for the lockout duration, and the failed-attempt counter is reset to zero.

While the lock is in force, the sign-in check sees the lock timestamp is still in the future and refuses the attempt outright, before it even compares the password. That is why a correct password entered during the window is still rejected. Attempts made during the lock do not raise the counter further; the account is already locked.

Once the window passes, the lock timestamp is in the past, the check clears, and a correct password succeeds. On success the counter resets to zero and the lock is removed, returning the account to a clean state. The default threshold is five attempts and the default duration is fifteen minutes, and both are policy values an administrator can change.

EDGEBIC also declines to reveal whether a username exists when credentials are wrong: the message is always the same generic "invalid username or password." The truth of what happened, including the failed attempts and the lock, is recorded in the audit log rather than shown to whoever is at the keyboard.

A Concrete Example

Alice has already mistyped her password three times. She tries twice more.

The fifth failure triggers the lock. The very next attempt, even with the right password, is refused because the account is locked, not because the password is wrong. After the window, the same correct password sails through and everything resets. A brute-force script trying thousands of passwords hits this wall every five tries and grinds to a near halt.

How EDGEBIC Uses It

Lockout is enforced inside the sign-in flow, so it applies to every entry point, and each lock is written to the security audit log as a lockout event alongside the failed attempts that led to it. That trail has no viewing screen, so the signal administrators actually watch is the Locked column on the Users screen under Settings, Security: a guessing attempt ends in a lock that shows up there, and the trail holds the attempt-by-attempt detail if the incident later needs documenting.

An administrator can unlock an account immediately when a real user is stuck, or adjust the threshold and duration to fit the site, weighing convenience against brute-force protection. For the record that captures these events, see the sibling term security audit log, and browse more definitions in the manufacturing glossary.