This causes users that have badPwdCount = $null to be excluded from the password spray.
Is there a reason for this or just a mistake?
Value could for example be $null if:
- User never logged on
- User never typed password wrong
- We have 'deny read' on the attribute
The last one seems a bit dangerous to ignore.
Fix would be to add else statement, where $attemptsuntillockout is still checked but $observation_window is ignored.