I am looking for a tool similar to Passprop (2000/2003) to allow local administrators to be locked out on windows 2008 member servers.Is anyone aware of one?

There is no need to use passprop.exe utility on Windows Server 2008 because they are affected by local policy and will be locked out after certain unsuccessful logon attempts. So you just configure Account lockaout settings and all members (including built-in administrators) will be monitored by this policy. http://www.sysadmins.lv

I too want to know how to lockout the built-in Administrator account after multiple attempts at Remote Desktop. Using SBS 2008, I do not find that the account lockout occurs. Something like passprop would certainly help. Vadims answer may be correct for some versions of 2008 servers, but it is not working that way for me on SBS 2008.

Hello, I was on the search for a newer version of passprop as well. Unfortunately Vadims anwser is not (quite) correct. I tested on Windows Server 2008 32bit and 64bit as well as Server 2008 R2. On all machines the built-in admin account is not effectively being locked-out. Just try to mount C$ from remote and yes the GUI under local users and groups will say "Account locked" once you've reached your configured limit of "Account lockout threshold". However, you can still continue mounting C$ from remote after you exceeded the threshold until you eventually enter the correct password. So the account is not being locked-out. Fortunately the good old passprop.exe from W2k resourcekit still does the job (on all newer Windows Versions). As soon as it has been applied, an attempt to mount C$ will fail with a message that the account has been locked out. So there are two question a) Isn't it a bug, that the GUI says the account is locked although it effectively is not? and b) What excately does passprop /adminlockout do and is there any powershell or similar script that can do the same thing? Thanks for helping out. Mike