I have been in a discussion lately with our security team, and I want to get an answer from this group.
Currently our security policy states that domain accounts will lock out after 5 failed attempts. This goes for all domain accounts, including service accounts. To be clear, I refer to a service account as an account used by applications to authenticate and "run" as that user.
I see a big problem with allowing service accounts to lockout, it creates an easy DoS for that service. Any rogue employee who knows the account, can simply fail 5 login attempts and the service will stop as it can no longer communicate with databases, and other servers. I have locked out accounts setting up a new server and having an extra space at the end of the password.
I ask, given the risks, why should service account be allowed to lock out after x number of failed logins?