Why is it important to obtain the domain user password policy before performing a password brute-force attack?

To avoid locking out user accounts during the attack, you must first know the account lockout threshold and lockout duration. If you brute-force without this knowledge, you could exceed the threshold and lock accounts, which not only fails the attack but also alerts defenders. For more details, see [Penetration Basics - Obtaining Domain User Password Policies](/news/penetration-basics-obtaining-domain-user-password-policies) and the follow-up [Penetration Basics - Brute-Forcing Domain User Passwords via LDAP Protocol](/news/penetration-basics-brute-forcing-domain-user-passwords-via-ldap-protocol).