Managing Account Lockout

User Accounts are vulnerable to dictionary attacks or brute force attacks. These attacks are ones where user credentials are deduced through successive attempts. Using tools or scripts enable the attacker to automate the process and establish a positive match more quickly and efficiently.

The "Good Practices" would be:

1. Design usernames which are not predictable or guessable.
2. Strong password policy.
   
3. Disable user account after n failed login attempts which are successive.
4. You could also consider locking out account for a specified amount of time. For e.g. 30 mins.
5. Display generic error messages to user on failed login attempt. E.g. "Authentication Failed - Invalid Username / Invalid Password / Account Locked
6. No automatic account lockouts for admin accounts
   
7. Implement CAPTCHA's to prevent bots or automated username/password guessing.