The question is not really clear. If the requirement is to lock out a user account after n failed logins, SQL Server does not provide this facility. SQL Server also cannot force time-based mandatory password changes. All security requirements of this nature must be addressed via custom application or, perhaps, some third-party product. We wrote our own custom login application that applies to all applications on multiple servers to manage mandatory password changes, mandatory password strength, account lockout, etc.