能否为OS X/macOS设备配置错误密码锁定及重试限制机制？

Absolutely, you can set up a failed password lockout mechanism tailored exactly to your needs—either requiring a waiting period or admin authorization to unlock locked accounts, which is perfect for fending off brute-force attacks. Let’s break down how to implement this across your OS X 10.10 to macOS 10.13 devices, given your setup with standard user accounts and a central admin account.

Built-in Retry Delays (Basic Lockout) #

First, macOS has a native way to add increasing delays after failed password attempts. This slows down brute-force attempts automatically:

Graphical Interface (Per User) #

• Open System Preferences > Users & Groups on the target Mac.
• Click the lock icon in the bottom-left and authenticate with your admin account.
• Right-click the standard user in the left sidebar and select Advanced Options.
• Look for the Password Retry Options section here. You can configure delays that increase with each failed attempt (e.g., starting at 1 second, doubling each time until a max limit).

Command Line (Global or Per User) #

For faster setup or batch management, use terminal commands:

• To set a global delay for all users (e.g., 60 seconds after failed attempts):

  sudo defaults write /Library/Preferences/com.apple.loginwindow FailedLoginDelay -int 60
  sudo defaults write /Library/Preferences/com.apple.loginwindow RetriesUntilHint -int 3
  

  RetriesUntilHint sets how many failed attempts trigger a password hint.

• To configure per-user delays:

  sudo dscl . create /Users/[standard-username] FailedLoginDelay 60
  sudo dscl . create /Users/[standard-username] FailedLoginCount 0
  

Admin-Required Unlock (Enhanced Security) #

To force an admin account to unlock a locked user (instead of just waiting), use the pwpolicy command—this is supported across all your target OS versions:

Per-User Policy Setup #

Run this command on each target Mac (replace placeholders with your details):

sudo pwpolicy -u [standard-username] setpolicy "maxFailedLoginAttempts=5; unlockTime=0; requiresAdminToUnlock=1"

Let’s break down the parameters:

• maxFailedLoginAttempts=5: Locks the account after 5 consecutive failed password attempts.
• unlockTime=0: Disables automatic unlocking after a wait time (so admin authorization is mandatory).
• requiresAdminToUnlock=1: Enables the admin unlock requirement.

If you want both options (wait or admin unlock), set unlockTime to a value in seconds (e.g., 300 for 5 minutes). Users can either wait 5 minutes or ask you to unlock the account immediately.

How to Unlock a Locked Account #

When a standard account is locked:

• At the login screen, you’ll see a prompt stating the account is locked.
• Switch to your admin account (use fast user switching or select it from the login window list).
• Open System Preferences > Users & Groups, unlock the pane, right-click the locked user, and select Unlock Account.
• Enter your admin password to restore access.

Bulk Management for 7 Devices #

Manually setting this up on 7 Macs is tedious—here’s how to streamline it:

1. Ensure Remote Login is enabled on all target Macs (System Preferences > Sharing > Remote Login).
2. From your OS X 10.10 management terminal, use ssh to run commands remotely:

   ssh admin@[target-mac-ip] "sudo pwpolicy -u [standard-username] setpolicy 'maxFailedLoginAttempts=5; unlockTime=300; requiresAdminToUnlock=1'"
   

3. For even easier batch management, use Apple Remote Desktop (available on your 10.10 Mac) to push commands or configuration profiles to all devices at once.

Verifying the Setup #

Test the lockout mechanism to make sure it works:

• On a test user account, enter the wrong password 5 times (or whatever number you set).
• Confirm the account locks, then try either waiting the set time (if enabled) or using your admin account to unlock it immediately.

Key Notes #

• Always back up user data before making account policy changes—better safe than sorry!
• OS X 10.10 has minor pwpolicy differences compared to newer versions, so test commands on one device first before rolling out to all 7.
• Keep your admin account password secure—it’s the key to unlocking locked user accounts.

内容的提问来源于stack exchange，提问作者sam