Fix STATUS_ACCOUNT_LOCKED_OUT (0xC0000234) Fast

30-Second Fix: Unlock the Account

This error means Windows (or Active Directory) locked the account after too many bad password attempts. The culprit is almost always someone typing the wrong password repeatedly—could be you, a service, or a scheduled task.

If you're on a local machine (not domain-joined):

1. Log in as another admin account (or use the built-in Administrator account).
2. Press Win + R, type lusrmgr.msc, hit Enter.
3. Find your locked account in the Users folder, right-click it, select Properties.
4. Uncheck Account is locked out, click OK.
5. Log out and log back in with your normal account.

If you're on a domain:

1. Contact your domain admin—only they can unlock a domain account. But if you're the admin, keep reading.

That's it. Took 30 seconds. If the lockout keeps happening, move to the next step.

5-Minute Fix: Reset the Password and Check Stuck Services

If the account locks again right after unlocking, something's still hammering it with bad passwords. Here's what to do:

Reset the password from an elevated command prompt

net user username NewPassword123! /domain

Replace username and NewPassword123! with your actual username and a strong password. Drop /domain if it's a local account.

Pro tip: Set a password that's never been used before. Old passwords cached in some app can retrigger the lockout.

Find and kill the stuck service or scheduled task

Stale services with saved wrong credentials are the most common recurring lockout cause. Run this to see what's running under that account:

sc query | findstr /i "username"

Or check Task Scheduler: look for tasks set to run as your user. Right-click each one, go to Properties > Change User or Group, and verify the password is current.

If you find one, update the credentials or stop the service. Then unlock the account again—it'll stay unlocked this time.

15+ Minute Fix: Deep Dive into Audit Logs and Lockout Source

If the above doesn't stick, the issue is systemic. You need to trace where the bad attempts are coming from. Here's the no-BS method:

Enable advanced audit logging (if not already)

auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

Check Security Event Log for lockout events

Open Event Viewer, go to Windows Logs > Security. Filter by Event ID 4740 (account lockout) and 4625 (failed logon). Look for:

• Source Network Address – the IP that's hammering the account
• Caller Process Name – the process making the bad logon attempts

If you see an IP, check if it's a known machine running a rogue service or a brute-force attack. Block it at the firewall.

Use LockoutStatus tool (Microsoft's own, free)

Download LockoutStatus.exe from Microsoft's site (part of the Account Lockout Tools). Run it against your domain controller. It shows:

• Which DC last locked the account
• The time of the lockout
• The bad password count

This tells you exactly where to focus. If one DC shows lockouts but others don't, that DC might have a cached credential issue or a misconfigured service.

Check for cached credentials in Windows Credential Manager

On the machine that's locking the account, open Control Panel > User Accounts > Credential Manager. Look for any saved credentials tied to your locked account—delete them. Stale Outlook, VPN, or mapped drive credentials often cause this.

If you're still stuck, reset the account password in Active Directory Users and Computers, and force a sync across all DCs:

repadmin /syncall /AdeP

Then unlock the account from ADUC, not from lusrmgr—ADUC trumps local settings on a domain.

One last thing: check the Account lockout threshold in Group Policy. If it's set to something stupid like 2 or 3 attempts, bump it to 10. That gives legitimate users room without compromising security. You'll find it under Computer Configuration > Windows Settings > Security Settings > Account Policies > Account Lockout Policy.

Bottom line: 90% of the time, the 30-second fix works. The other 10% is a stuck service or bad cache. Don't waste time rebooting servers or reinstalling the OS—that's for rookies. Trace the source, kill it, unlock the account. Done.