[Brockbridge]

am trying to pick up knowledge about group policy
I am currently on the section about setting security links on the GPM. On my test network at home I have account lockout policy set at: after three unsuccessful logon attempts the user would have to contact the administrator:

I am aware of the
site
domain
ou
the further down the food chain you go if you like sets the GPO, e.g setting a GPO at OU level takes presidents over any settings at domain level.

This is my question
when I first started to use the GPM I set the account lockout policy at site and domain level, the setting being after three unsuccessful logon attempts the user would have to contact the administrator: then I tried to change the account lockout policy at OU level setting it to one unsuccessful logon attempt, but no can do? I have deleted all links above the OU regarding account lockout policy, , the steps I am taking are, I am putting my two desktops in a OU in active directory called sales computers, then in the GPM I have created a OU called sales computers both being under the parent OU of sales dept, then created a link to the sales ou in the GPM where I have configured it to of coarse one unsuccessful log on attempt, but it is not having it, once I gpupdate and reboot my two computers I still have the three unsuccessful logon attempts, not the one I have changed at the sales OU level.
I have also tried setting the OU level setting to one unsuccessful logon attempt to user instead of computers at the sales OU in the GPM but no can do? I have looked into it a bit and I was told you can only set the account lockout policy once and then that is it? but I do not believe that at all.
does anyone have any suggestion I have been playing around with it all day and still I cannot change the sales OU to one unsuccessful logon attempt contact the administrator, from the three attempts that were already set?

many thanks

Brockbridge