By default, Windows NT 4.0 doesn't let you lock out administrator user accounts. In other words, administrator accounts aren't subject to the Windows account policy, and the result is a security risk. Can I change this default behavior?
You can use the Microsoft Windows NT Server 4.0 Resource Kit's passprop.exe tool to change this behavior. To enable account lockouts for administrators, at the command prompt type
To disable account lockouts, type
The passprop.exe lockout-behavior change applies only to administrators' network logons and logons to nondomain controller (DC) member servers or workstations, not to administrators' interactive logons to DCs.