Lockout protects accounts against password guessing. If someone enters a wrong password several times in a row, the system temporarily locks the account and unlocks it again on its own after the configured time. This feature is enabled by default.
You will find the settings in System settings, tab Main, box Lockout after failed sign-in attempts. Lockout is independent of the password policy - it can be used without enforcing password complexity.
A locked account is unlocked automatically when the lock duration expires. It can be unlocked sooner in these ways:
Locked accounts are marked in the user list with a lock icon in the account state column. Hovering over it shows the text "Temporarily locked until …". The same state is shown by a yellow badge on the user card. Once the lock expires, the account is automatically shown as active again.