$ 0 0 This is set and can be changed in the web.config in the membership provider - http://msdn.microsoft.com/en-us/library/system.web.security.membership.maxinvalidpasswordattempts.aspx