
Right now, when a user is locked out the only way I can tell is by looking at the attributes below.

One is likely to assume that once the "accountUnlockTime" attribute has been set on an account, the account is indeed locked out.

accountUnlockTime: 20210920190503Z
passwordRetryCount: 3
retryCountResetTime: 20210920181413Z

[mstarling@dsa101 ~]$ dsconf -W -D cn=manager ldaps://dsa101.mydomain.com:636 pwpolicy get

Global Password Policy: cn=config

------------------------------------

nsslapd-pwpolicy-local: on

passwordstoragescheme: SSHA512

passwordchange: on

passwordmustchange: off

passwordhistory: on

passwordinhistory: 10

passwordadmindn: cn=Generic_PasswordPolicy_Override,ou=LDAPadmin,dc=mydomain,dc=com

passwordtrackupdatetime: on

passwordwarning: 86400

passwordisglobalpolicy: on

passwordexp: on

passwordmaxage: 7776000

passwordminage: 86400

passwordgracelimit: 0

passwordsendexpiringtime: off

passwordlockout: on

passwordunlock: on

passwordlockoutduration: 600

passwordmaxfailure: 5

passwordresetfailurecount: 600

passwordchecksyntax: off

passwordminlength: 48

passwordmindigits: 0

passwordminalphas: 0

passwordminuppers: 0

passwordminlowers: 0

passwordminspecials: 0

passwordmin8bit: 0

passwordmaxrepeats: 0

passwordpalindrome: off

passwordmaxsequence: 0

passwordmaxseqsets: 0

passwordmaxclasschars: 0

passwordmincategories: 5

passwordmintokenlength: 3

passwordbadwords: athena health interface

passworduserattributes: cn uid sn givenName mail gecos homeDirectory

passworddictcheck: on

passworddictpath: /usr/lib64/security/pam_cracklib.so

nsslapd-allow-hashed-passwords: on

nsslapd-pwpolicy-inherit-global: on

dsconf -W -D cn=manager ldaps://dsa101.mydomain.com:636 localpwp get "ou=People,dc=mydomain,dc=com"

Local Subtree Policy Policy for "ou=People,dc=mydomain,dc=com": cn=cn\3DnsPwPolicyEntry_subtree\2Cou\3DPeople\2Cdc\3Dmydomain\2Cdc\3Dcom,cn=nsPwPolicyContainer,ou=People,dc=mydomain,dc=com