This issue applies to any system, Windows or otherwise. I can create a simple program that will lockout every account on every AD domain in an organization, the impact would be huge, and it would be very difficult to recover from such an attack. The only thing required is a list of usernames/domains, which are available to anyone who logs on the network.
Simply put, if your passwords are so weak that they can be brute-forced, you're problem isn't account lockout.
Here are some perspectives from various sources at Microsoft:
"Bad Password Threshold is set too low: This is one of the most common misconfiguration issues. Many companies set the Bad Password Threshold registry value to a value lower than the default value of 10. If you set this value too low, false lockouts occur when programs automatically retry passwords that are not valid. Microsoft recommends that you leave this value at its default value of 10. "
Troubleshooting Account Lockout
What should I set account lockout to?
"You should turn it off. Account lockout is a feature that locks out an account after a certain number of attempts to log on with an incorrect password. It is designed to protect the computer against weak passwords. The problem is that weak passwords will eventually fall to an attack anyway, regardless of account lockout. The smart attacker will simply modify the attack in such a way as to not trigger the account lockout. A weak password will resist longer against such an attack when account lockout is used, but it will still eventually be broken."
"In addition, account lockout makes it trivial for a less sophisticated attacker to disable the computer completely. A simple batch file can be used to lock out every account on the computer, thereby crippling it. Account lockout, while designed to protect against weak passwords, instead create a condition where a trivial denial of service attack is possible."
Frequently Asked Questions About Passwords