---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Control Lockout Time for Invalid Password Reset Attempts

# Control Lockout Time for Invalid Password Reset Attempts {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The password_reset.request.max_attempt_window property controls
the number of minutes a user must wait to reset or change their password after exceeding the
maximum number of unsuccessful attempts that is set with the
password_reset.request.max_attempt property.
The password_reset.request.max_attempt_window system property defines the number of minutes a user must wait to reset or change their password after exceeding the maximum number of unsuccessful attempts that
is set with the password_reset.request.max_attempt property.

Ensure that the property password_reset.request.max_attempt_window is set to 1440 or greater.

## More information {#sc-reset-password-request-max-attempts-window__section_wc1_cqn_phc}

{#sc-reset-password-request-max-attempts-window__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | password_reset.request.max_attempt_window |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Integer |
| Recommended value | An integer greater than or equal to 1440 |
| Default value | \<none\> |
| Fallback value | 1440 |
| Category | [Authentication](https://www.servicenow.com/docs/b9CEYnMpryNiLMZU_fh~Tw "The authentication category covers the main elements of modern authentication to confirm an entity and its claims are authentic and correct, resistant to impersonation and prevent interception of passwords.") |
| Security risk | * Severity score: * CVSS rating: * Security risk details: A value too low increases the risk of successfully brute forcing a password as a greater number of password reset attempts can be made. {#sc-reset-password-request-max-attempts-window__ul_g1g_3sf_xwb} |
| Functional impact | None |
| Dependencies and prerequisites | None |
[ ]

{#sc-reset-password-request-max-attempts-window__table_ajc_b43_3kb}