Windows should be smart enough to know an empty password doesn't meet the password complexity requirements or is of length zero and not count it against the 'bad password count'.
All that logic sounds like a recipe for introducing a side channel attack into the system. Much better to keep things simple.
But it does. And if you have someone malicious trying to access the machine that way, why not lock them out on the first attempt?
I can see the advantage in simplifying things by not submitting blank passwords also, although I also think it isn't necessary.
> not exactly going to resuilt in success on the 1 millionth attempt.
Not, but 2 or 3 attempts should lock the account. I don't see an issue in treating a blank password submission as an attempt, but I guess denying that is easier than trying to educate users.