Fix Windows Error 0X00000A8E: Locked Out Account

I know that sinking feeling when you type your password wrong a few times and Windows slams the door with error 0X00000A8E. The account is locked out. It's infuriating, especially when you're in a hurry. Let's get you back in.

The Quick Fix: Unlock the Account

This error happens because your Windows account (local or domain) has a lockout policy—usually 5 to 10 bad password attempts in a short window. The fix depends on whether you're on a local machine or a domain network.

For Local Accounts (Windows 10/11 Pro or Home)

If you're not on a corporate network, here's the fastest way:

1. Reboot the PC. Sometimes a restart clears a temporary lockout (if the policy isn't set by Group Policy).
2. If reboot doesn't work, boot into Safe Mode with Command Prompt. Press Shift + Restart from the login screen, then Troubleshoot > Advanced Options > Startup Settings > Restart, then press 4 or F4.
3. Once in Safe Mode, open Command Prompt as Administrator (if you see it) or log in with the built-in Administrator account (often disabled by default, but on some systems it's available).
4. Type:

   net user [username] /active:yes

   Replace [username] with your actual account name. Then type:

   net user [username] /logonpasswordchg:yes

   This forces a password change on next login.
5. Reboot and log in with your existing password—then change it when prompted.

For Domain Accounts (Corporate Networks)

If you're on a domain (like most offices), you can't unlock yourself unless you're a domain admin. Here's what to do:

1. Call your IT helpdesk or a colleague with admin rights. They need to open Active Directory Users and Computers (ADUC).
2. They right-click your user object, select Properties, go to the Account tab, and check "Unlock account."
3. Alternatively, from an elevated PowerShell on a domain controller or admin workstation:

   Unlock-ADAccount -Identity [username]

Skip the old-school net user [username] /domain approach—it works but PowerShell is faster and less error-prone.

Why This Error Happens

Windows has a security feature called "Account Lockout Threshold." By default, after 5 invalid login attempts within 15 minutes, the account gets locked for 15 to 30 minutes (or until an admin unlocks it). This protects against brute-force password guessing.

Real-world triggers include:

• You mistyped your password because you changed it recently and muscle memory kicked in.
• A scheduled task or service is using old cached credentials (common with VPNs or network drives).
• Someone or something is trying to access your account—like a misconfigured app or an actual attacker.

Less Common Variations of the Same Issue

Error 0X00000A8E on Windows Server

If this pops up on a server, it's usually the built-in Administrator account getting locked out after Remote Desktop failed attempts. Fix: Log in locally (physical console or iLO/DRAC) and run net user administrator /active:yes.

Error Appears on One App but Not Another

Sometimes you see it when trying to access a shared folder or SQL Server, but you can still log into Windows. That means the service account or credential set for that specific resource got locked. Check Windows Credential Manager (Control Panel > Credential Manager > Windows Credentials) and remove any stale entries for that server.

Account Lockout Loop After Password Change

You change your password, but a mapped drive or Outlook profile keeps using the old one. The lockout keeps re-triggering. Fix: Disconnect all network drives and restart Outlook. Then reconnect drives with the new password.

Prevention: Stop It Before It Starts

Three things you can do right now:

1. Use a password manager. Typing manually invites typos. Let a tool like Bitwarden or KeePass auto-fill your credentials.
2. Check for credential leaks. Run net use in Command Prompt to see all active connections. Remove any that are broken or old with net use * /delete.
3. Ask your admin to increase the lockout threshold. If you're in a low-risk environment, bumping it from 5 to 10 attempts gives you more room. On Windows 10 Home/Pro, you can adjust this via secpol.msc > Account Lockout Policy > Account Lockout Threshold. Set it to 0 to disable lockout (not recommended for business laptops).

Last tip: if you're a sysadmin, enable lockout event logging (Event ID 4740) and set up a daily check. That way you catch lockouts before your users call you. Saves everyone a headache.

That's it. You're unlocked. Now go grab a coffee—you earned it.