Yes, the default ADMINISTRATOR can be locked out (wait!)

What I mean is that if you have a lockout threshold of lets say 5, the lockoutTime attribute will show the lockout date and time the account was locked. In ADUC (using another custom admin account for example) you will see the default ADMINISTRATOR is locked.... you will even see and event ID 644 mentioning the account lockout.

HOWEVER.... here it comes...

While the default ADMINISTRATOR is locked, it will be unlocked automatically by the SYSTEM (DC) AS SOON AS the correct password is used (even before it is unlocked after the unlock period)

 

Cheers,

Jorge

------------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test before implementing!
------------------------------------------------------------------------------------------------