https://www.bleepingcomputer.com/news/security/using-account-lockout-policies-to-block-windows-brute-force-attacks/

A strong account lockout policy is one of the most effective tools for stopping brute force authentication attempts on Windows domains.

Once an attacker enters an incorrect password so many times, the account becomes locked. This prevents any additional attempts until an administrator unlocks the account.