Maximize reset password request unlock window duration [Updated in Security Center 1.3]
The password_reset.request.unlock_window property controls the number of minutes a user must wait to start a reset request after the last successful unlock account action.
This property controls the number of minutes a user must wait to start a reset request after the last successful unlock account. If password_reset.request.unlock_window is not set to the recommended value of 1440 or more, it increases the opportunity for a malicious actor from brute forcing the user's password using automated tools.
More information
| Attribute | Description |
|---|---|
| Property name | password_reset.request.unlock_window |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | Authentication |
| Purpose | It denotes the time period in minutes that a user must wait after successfully resetting the password to reset the password again. |
| Recommended value | 1440 |
| Default value | 1440 |
| Configuration type | Positive integer values |
| Security risk | (High) If the property is not set to the recommended value of 1440 or greater, then it increases the opportunity of a malicious actor to brute force password access using automatic tools. |
| Security risk rating | 5.9 |
| References | Configure Password Reset properties |
To learn more about adding or creating a system property, see Add a system property.