By default, Windows NT 4.0 doesn't let you lock out administrator user accounts. In other words, administrator accounts aren't subject to the Windows account policy, and the result is a security risk. Can I change this default behavior?

You can use the Microsoft Windows NT Server 4.0 Resource Kit's passprop.exe tool to change this behavior. To enable account lockouts for administrators, at the command prompt type

                              passprop /adminlockout

To disable account lockouts, type

                              passprop /noadminlockout

The passprop.exe lockout-behavior change applies only to administrators' network logons and logons to nonĀ­domain controller (DC) member servers or workstations, not to administrators' interactive logons to DCs.