0X00000533

Fix ERROR_ACCOUNT_DISABLED (0X00000533) – Logon failure: Account currently disabled

Windows Errors Beginner 👁 6 views 📅 Jun 18, 2026

When Windows says an account is disabled, it's usually because someone turned it off in Active Directory or Local Users. This guide shows you how to re-enable it fast.

1. The most common cause: someone disabled the user account in Active Directory

This error pops up when a domain user tries to log in and their account has been disabled by an admin. Maybe the user left the company and got rehired. Maybe IT locked it after too many bad passwords. The fix is to re-enable it in Active Directory Users and Computers (ADUC).

Here's what you do:

  1. Open ADUC on a domain controller or a machine with RSAT installed. Press Win + R, type dsa.msc, hit Enter.
  2. In the left pane, expand your domain and find the Users folder (or the OU where the account lives).
  3. Find the user with the disabled account. Look for a small down arrow on the user icon — that's the tell.
  4. Right-click that user and select Enable Account.
  5. After you click it, a box pops up saying the account is enabled. Click OK.
  6. What to expect: The down arrow disappears from the user icon. The account is now active.
  7. Close ADUC. Ask the user to try logging in again.

If the user still can't log in, check their password. A disabled account doesn't change the password — it just blocks login. You might need to reset the password separately.

2. Second cause: account disabled in Local Users and Groups (local machine, not domain)

Sometimes this happens on a standalone Windows 10 or 11 machine, or a server that's not joined to a domain. Maybe a tech disabled the built-in Administrator account, or a user account got turned off through a group policy. The fix is through Local Users and Groups (lusrmgr.msc).

  1. Press Win + R, type lusrmgr.msc, hit Enter. If you're on Windows Home edition, lusrmgr.msc isn't available — see the command-line fix below.
  2. In the left pane, click Users.
  3. Find the disabled account. It has a small down arrow on the icon, just like in ADUC.
  4. Right-click the user and select Properties.
  5. Uncheck the box that says Account is disabled.
  6. Click Apply, then OK.
  7. What to expect: The down arrow disappears. The account is enabled.
  8. Close the console. Have the user try logging in.

Heads up for Windows Home users: lusrmgr.msc won't work. You'll need to use the command line method below instead.

3. Third cause: group policy set the account to disabled

Group Policy can disable accounts too. This is rarer, but I've seen it. A policy like "Accounts: Administrator account status" can disable the built-in admin account. The fix is to check and change that policy.

  1. Press Win + R, type gpedit.msc, hit Enter. (This is only available on Windows Pro or Enterprise.)
  2. Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.
  3. In the right pane, find Accounts: Administrator account status.
  4. Double-click it. If it says Disabled, choose Enabled.
  5. Click Apply, then OK.
  6. What to expect: The policy now allows the admin account to be active. But you still might need to manually enable it using one of the other methods above.

Also check user-specific policies under Computer Configuration > Administrative Templates > System > Logon. Look for policy named "Allow log on locally" — if the user account isn't listed there, add it. Without that, even an enabled account can't log in.

Quick fix using the command line (works on all Windows versions)

If you don't want to click through menus, use the net user command. You need admin rights for this.

  1. Open Command Prompt as administrator: press Win + X, select Command Prompt (Admin) or Windows PowerShell (Admin).
  2. Run this command, replacing username with the actual account name:
net user username /active:yes

For example, to enable the Administrator account:

net user Administrator /active:yes

What to expect: The command returns "The command completed successfully." If you see an error, make sure you're running as admin and you typed the name right.

After that, test the login.

Quick-reference summary table

Cause Tool to use Steps What to check after
Disabled in AD Active Directory Users and Computers (dsa.msc) Right-click user → Enable Account User icon changes, no down arrow
Disabled locally Local Users and Groups (lusrmgr.msc) or net user command Uncheck disabled box, or run net user username /active:yes Down arrow gone from icon
Group Policy disabled Local Group Policy Editor (gpedit.msc) Set "Accounts: Administrator account status" to Enabled; check logon rights Policy change applied, account still might need manual enable

That's it. Nine times out of ten, the account got disabled by a person or a script. Re-enable it in the right place, and the user is back in business.

Was this solution helpful?

ERROR_ACCOUNT_DISABLED 0X00000533 logon failure account disabled Windows account disabled fix enable disabled user account Active Directory enable user Local Users and Groups enable Net User command enable Windows 10 disabled account Windows Server disabled account user account disabled troubleshooting