We are using 6.0.6CE and it is not paying attention to the maxfailure lockout value. There is a default password policy in the DB, and maxfailure is set to 3, but it always takes 5 times to lock the account out. We are programmatically setting the password policy using the com.liferay.portal.model.PasswordPolicy class, the admin menu isn't an option for us since in our implementation we have removed it from the interface completely. Is there another setting that controls the lockout?

I think there was a bug in 6.0.5. The following thread post a similar problem. If you're programming, you'll just have to set your program to "correct" the retry difference to the way 6.0.5 handles it. Another option is to correct liferay code.

http://www.liferay.com/community/forums/-/message_boards/message/11620432

Thanks, that was it. I set maxfailure to 1 and it fails on 3.