I know this error is infuriating—you're staring at a login screen that won't let you in, and all you did was mistype your password a few times. Let's get you back in.
The Quick Fix: Reset the Lockout Counter
If you're sitting at the locked machine and have admin access to another account, skip the drama. Open Command Prompt as Administrator and run:
net user <username> /active:yesThat clears the lockout flag immediately. Replace <username> with the actual account name (like jdoe). If you don't know the exact spelling, run net user to list all accounts first.
If you're locked out of a domain account, you'll need a domain admin to run this on a domain controller:
net user <username> /domain /active:yesThat's the same command, but with /domain and admin rights in Active Directory. It works instantly—no restart needed.
What about the built-in Administrator?
If you only have one account and it's locked, boot into Safe Mode. At the login screen, the built-in Administrator account appears. Log in with that (default password is often blank, set during setup). Then run the net user command from there.
Why This Works
Windows counts failed login attempts and, when you hit the lockout threshold (default is 10 on standalone machines), it disables the account for a set time—usually 10 minutes. The /active:yes flag flips the account back to enabled, bypassing the waiting period. Simple, but only works if you have another admin account or access to Safe Mode.
If you're locked out of a Microsoft account, the local command won't help. You'll need to reset your password online at account.live.com. That's a different beast—the lockout is tied to your Microsoft account's security, not the local policy.
Less Common Variations
Locked Out in Active Directory
Domain accounts have their own lockout threshold and observation window, which your IT admin sets. If you're in a corporate environment, you can't fix this yourself—you need a domain admin to reset the account or wait out the lockout duration. If you see this error across multiple machines, the real issue is likely a scheduled task or service using old credentials, triggering lockouts repeatedly. Check for that in Event ID 4740 (domain) or 539 (local).
Lockout with Smart Card Logon
Sometimes the lockout happens when a smart card PIN is entered wrong. The fix is the same—reset the account—but the trigger is usually a user error, not a policy issue. If it keeps happening, your smart card middleware might be double-inserting the PIN. Update the middleware and check your card reader drivers.
Locked Out After a Password Change
Changing your password on one device while another device still uses the old password can lock you out. That's because the stale credential gets presented multiple times, counting against your lockout threshold. Solution: update passwords on all devices, or use a password manager that syncs.
Prevention: Stop Lockouts Before They Happen
First, adjust the account lockout policy if you're a standalone user. Open secpol.msc (Local Security Policy), go to Account Lockout Policy, and set the threshold higher or the lockout duration lower. For a home PC, I'd set the threshold to 5 and the duration to 15 minutes—enough to deter brute force, not enough to annoy you.
If you're an admin, the real fix is to ensure no service accounts are being used for scheduled tasks with weak passwords. Audit your services and tasks—anything running as a domain account should have a dedicated, secure service account with its own lockout policy.
Also, enable the “Reset account lockout counter after” to a reasonable time, like 15 minutes. That way, a user who mistypes once and waits 10 minutes won't trigger a lockout.
Final thought: If you keep getting locked out, it's not the system being mean. It's either a policy too strict for your habits or a program using bad credentials. Fix the policy or fix the program—don't just keep resetting.