Windows security baseline recommends a threshold of 10 invalid login attempts. This prevents accidental account lockouts and reduces the number of Help Desk calls.