NT Gatekeeper: Using Passprop.exe to Lock Out Administrator User Accounts

By default, Windows NT 4.0 doesn't let you lock out administrator user accounts. In other words, administrator accounts aren't subject to the Windows account policy, and the result is a security risk. Can I change this default behavior?

You can use the Microsoft Windows NT Server 4.0 Resource Kit's passprop.exe tool to change this behavior. To enable account lockouts for administrators, at the command prompt type

passprop /adminlockout

To disable account lockouts, type

passprop /noadminlockout

The passprop.exe lockout-behavior change applies only to administrators' network logons and logons to non­domain controller (DC) member servers or workstations, not to administrators' interactive logons to DCs.