Intruder detection settings

I've worked at several places with very different policies. At one company, government, we set the attempts at 6, lockout retention to 30 minutes, and length of lockout to 6 hours. We monitored the network all the time, and kept a tight rein on useraccess, so that seemed to work. The next company, attempts was set to 6, lockout retention to 14 days, and length of lockout to 45 days. This was a sloppy network, high user turnover, (20-30 users a week). We might not know for weeks if a user left,so a long lockout might keep accounts we didn't know were inactive from being accessed. The current company I'm at is very small, 40 users, and there was no lockout. I haven't done much with it because we're moving to NT. You have to look at your situation and see what fits with the company and network.
Hope that helps.