Fix ERROR_ACCOUNT_EXPIRED 0X00000701 – Quick Fix

If you're seeing ERROR_ACCOUNT_EXPIRED (0X00000701) when trying to log into Windows, it's not a broken system — your user account just hit its expiration date. This happens most often on company laptops where IT set a temporary account, or on shared machines where someone accidentally set an expiration date.

Fix 1: Extend or Remove Expiration Using Command Prompt

This is the fastest fix. You need local admin rights. If you're locked out already, boot into Safe Mode with Command Prompt or use the built-in Administrator account.

Open Command Prompt as Administrator. Type cmd in Start, right-click, choose Run as administrator.
Type this command to check your user's expiration:

net user %username% | find /i "expires"

It'll show something like Account expires - 12/31/2024 12:00:00 AM.

To remove the expiration completely (recommended):

net user %username% /expires:never

That's it. Log off and back in — the error is gone.

Why this works: The /expires:never flag sets the account's expiration date to 0 (meaning never). Under the hood, Windows stores this in the SAM registry as a FILETIME value. Setting it to never writes 0xFFFFFFFF as the expiration timestamp, which the local security authority (LSASS) interprets as "no expiry."

Fix 2: For Domain Accounts (Work/School PCs)

If your PC is joined to a domain, the local net user command might not work — the domain controller controls expiration. In that case:

Open PowerShell as Administrator.
Run:

Set-ADUser -Identity "yourusername" -AccountExpirationDate $null

You need domain admin rights for this. If you don't have them, call IT. No workaround there — the domain controller enforces this.

Why the domain version matters: Domain accounts get their expiration from Active Directory's accountExpires attribute. The local net user command only touches the local SAM, not AD. So if you're domain-joined and try Fix 1, it'll look like it worked but the real expiry is still on the DC. The Set-ADUser cmdlet talks directly to AD via LDAP to clear that attribute.

Less Common Variations

Sometimes the error shows up differently:

Error code 0x00000701 in Event Viewer — Check the Security log under Event ID 4648 or 4625. The reason code will say STATUS_ACCOUNT_EXPIRED.
VPN or RDP connections fail with this error — Even if local login works, the remote service checks expiration separately. Run the net user command on the remote machine.
Scheduled tasks fail with 0x00000701 — The task runs under an expired account. Open Task Scheduler, find the task, change the user account to one that's not expired, or extend the original account.

I've also seen this happen after a Windows 10 to 11 upgrade. The upgrade sometimes resets the expiration for built-in accounts like Guest or Administrator. Check those too if the error is on a secondary account.

Prevention

Set a reminder to check account expiration every 6 months if you're managing shared computers. Run this from an admin PowerShell:

Get-LocalUser | Where-Object { $_.AccountExpires -ne $null } | Format-Table Name, AccountExpires

This lists all local accounts with an expiration set. If you see anything in the past or near future, clear it with Set-LocalUser -Name "username" -AccountExpires $null.

For domain environments, set a group policy to warn users 14 days before their account expires. The setting is under Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. Look for Microsoft network server: Amount of time for warning before account expiration. Set it to 14.

One last thing — if you're using Azure AD joined devices (Microsoft 365 Business), account expiration is managed through the cloud. Check the user's ExpirationDate in the Microsoft 365 admin center or use PowerShell module AzureAD to set it:

Set-AzureADUser -ObjectId "user@domain.com" -AccountEnabled $true

But honestly, the local fix works for 95% of cases. Start there.