---
title: Authentication Failure Lockout Policy
canonical: https://openvpn.net/as-docs/v3/authentication-failure-lockout-policy/
product: Access Server Docs
---

# Authentication Failure Lockout Policy

Access Server automatically locks out user accounts after repeated failed authentication attempts to prevent brute-force attacks. When locked out, users see messages like "**LOCKOUT**" or "**User temporarily locked out due to multiple authentication failures**."

- The lockout triggers after **five** failed attempts within **15 minutes** and expires after **15 minutes**.
- Access Server tracks incorrect passwords in a lockout dictionary (stored as hashes). The dictionary is purged if it reaches its limit. The default settings are usually sufficient, but high-volume environments may require adjustments.
- External authentication systems (LDAP, RADIUS, SAML) may have their own lockout policies.

Admins can modify lockout settings or manually lift a lockout if needed.

## Configure the lockout policy

You can configure the lockout policy from the Admin Web UI or the command-line interface.

> **Important**
>
> If you’re using an external authentication system, that system might have its own lockout policy.

- [Tutorial: Configure the Authentication Failure Lockout Policy](https://openvpn.net/as-docs/v3/tutorials/tutorial--authentication-failure-lockout-policy.md)

## Manually unlock a locked-out user account

If you wish to unlock a locked-out user manually, follow the steps below.

> **Tip**
>
> You can't unlock a single, specific user. The steps below allow you to set the automatic lockout reset period to one second and then revert it back to the default value.

### Manually unlock a user from the Admin Web UI

1. Sign in to the Admin Web UI.
2. Click **Authentication**.
3. Under **Password lockout policy**, take note of your current value for the **Lockout release timeout in seconds**.
4. Set the value to **1**.
5. Click **Save** and **Update**.
6. Wait a few seconds and then set the value back to your initial value.

   > **Tip**
   >
   > Access Server's default lockout is set to 900 seconds, or 15 minutes.
7. Click **Save** and **Restart**.
   - The locked-out user can sign in again.

### Manually unlock a user from the CLI

1. Connect to your Access Server console and get root privileges.
2. Run these commands to set the lockout to one second, wait two seconds, and then set it back to the default value of 15 minutes. (If desired, modify the command for your preferred lockout time.)

   ```
   sacli --key "vpn.server.lockout_policy.reset_time" --value "1" ConfigPut
   sacli start
   sleep 2
   sacli --key "vpn.server.lockout_policy.reset_time" --value "900" ConfigPut
   sacli start
   ```
3. The locked-out user can sign in again.

---

Prev: [CA Certificate Management](https://openvpn.net/as-docs/v3/ca-certificate-management.md)
Next: [Advanced Security](https://openvpn.net/as-docs/v3/advanced-security.md)
Index: https://openvpn.net/as-docs/llms.txt