Yeah, getting locked out of your own account sucks. I've seen this a hundred times – you're typing in what you think is the right password, and boom, it says your account is locked. The culprit here is almost always the account lockout threshold in your domain or local security policy. Let's get you back in.
Quick Fix for Domain Accounts (Active Directory)
If you're on a corporate network, your IT guy needs to do this. But if you have admin rights, here's the exact command:
Unlock-ADAccount -Identity jdoe
Or use the old-school net user command:
net user jdoe /domain /active:yes
If the account is locked AND disabled, run net user jdoe /domain /active:yes again. It toggles both.
Quick Fix for Local Accounts (Standalone PC)
If it's just your local machine, boot into Safe Mode with Command Prompt. Then:
net user jdoe /active:yes
Or reset the lockout counter:
net accounts /lockoutwindow:0
Then change it back to something sensible:
net accounts /lockoutwindow:30
This clears the bad attempt count.
Why This Happens
Windows (or Active Directory) counts failed login attempts. When you hit the threshold – default is usually 5 to 10 bad tries – the account gets locked for a set duration. The lockout prevents brute-force attacks. But if you fat-finger your password or have a service account with a wrong cached credential, you'll lock yourself out.
The lockout timer starts after the last bad attempt. So if you try 5 times, wait 10 minutes, try again, the counter resets only if the lockout window (usually 30 minutes) has passed since the last attempt. That's why sometimes you wait an hour and it unlocks itself.
Less Common Variations
Account Locked But No Bad Attempts in Logs
Check Event ID 4740 (security log) on your domain controller. If you see a lockout but no failed logins from your PC, you've got a credential leak – a saved password in a scheduled task, a mapped drive, or a service under your account. Run this to find it:
Get-ADUser jdoe -Properties LockedOut,LastBadPasswordAttempt
Account Unlocks Then Locks Again
This is the classic stale session problem. You changed your password, but an old session (like Outlook, a network share, or a VPN) keeps trying the old password. Kill all sessions, reboot, then change the password again. Check Event IDs 4625 (failed logon) for the source IP – it'll tell you which machine's doing it.
Account Locked After Password Reset
You reset the password, but the account stays locked? That's because the new password hasn't synced to all domain controllers yet. Wait 5-10 minutes, or force replication:
repadmin /syncall /AdeP
How to Stop This From Happening Again
- Set a longer lockout threshold. 10-15 attempts instead of 5. Gives you room for typos.
- Set a short lockout duration. 15 minutes is fine. Anything longer just frustrates users.
- Use a password manager. Stop memorizing passwords. Type them correctly every time.
- Check for service accounts. If a service runs under your user account, that's a ticking time bomb. Set up a dedicated service account instead.
- Enable account lockout auditing. Track who gets locked out and why. Saves troubleshooting time.
That's it. Fix it now, and you won't see this error again – unless you forget your password again. Then it's on you.