STATUS_ACCOUNT_EXPIRED (0xC0000193) — user account expired fix

You're logging into a domain-joined Windows machine — could be Windows 10 22H2, Server 2019, whatever — and you get slapped with this: STATUS_ACCOUNT_EXPIRED (0xC0000193). The screen might say "The user account has expired". This almost always hits after a user hasn't logged in for a while, or right after HR deactivated a contractor account in AD. Sometimes it happens overnight when the account expiration date you set last month finally catches up.

Here's the deal: every Windows user account — local or domain — has an optional account expiration date. When that date passes, Windows won't let anyone authenticate with that account. The error code 0xC0000193 is just Windows saying "nope, this account's time is up."

Don't confuse this with a password expiry — that gives you a different error (STATUS_PASSWORD_EXPIRED, 0xC0000071). This is specifically about the account itself being disabled via date.

What causes it

• An IT admin set an expiration date on the user account in Active Directory Users and Computers (ADUC) or via PowerShell.
• The account was created with a default expiration policy (some orgs set all contractor accounts to expire after 90 days).
• On a local machine, someone manually set an expiration using net user or the Local Users and Groups MMC snap-in.
• A scheduled script or HR system automatically expired the account after a termination date.

The fix — clear the expiration

Option 1: Domain account (Active Directory)

1. Open Active Directory Users and Computers (dsa.msc) on a domain controller or a machine with RSAT installed.
2. Find the user account that's failing. Right-click it and choose Properties.
3. Go to the Account tab.
4. Look at the bottom of the tab — there's a section called Account expires.
5. Select Never and click OK.
6. Wait for AD replication (or force it with repadmin /syncall). Then have the user try logging in again.

If you want to do it via PowerShell:

Set-ADUser -Identity "username" -AccountExpirationDate $null

Option 2: Local account (standalone PC)

1. Open an elevated Command Prompt (Run as administrator).
2. Type net user username (replace username with the actual account name) and press Enter. You'll see the account expiration date listed under Account expires.
3. To remove the expiration, run:

net user username /expires:never

That's it. The account should work immediately.

Alternative via Local Users and Groups (lusrmgr.msc):

1. Open lusrmgr.msc -> Users.
2. Double-click the affected user.
3. Uncheck Account expires or change the date.

What to check if it still fails

• Replication delay — In multi-domain controller environments, the change might take a few minutes to propagate. Use repadmin /showrepl to check.
• Account is disabled — The account expiration isn't the same as the account being disabled. Check the Account tab in ADUC to see if the account is enabled.
• Password expired — Even if you fix the expiration, a stale password can still block login. Ask the user to reset their password or force a change.
• Cached credentials — If the user was previously logged in with cached credentials, Windows may still enforce the old expiration. Clear cached credentials by deleting the contents of %userprofile%\AppData\Local\Microsoft\Credentials after backing them up.
• Group Policy — Some GPOs enforce account expiration policies. Check Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy — though that's rare.
• Third-party identity management — Tools like Okta, Azure AD Connect, or CyberArk might override local AD settings. Check if the account is managed by one of those.

One more thing — If you're seeing this error on a service account or a computer account, the same fix applies. Computer accounts rarely expire, but I've seen it happen when an admin manually set an expiration on a machine that was offline for months.

Bottom line — 0xC0000193 is one of the easiest AD errors to fix. You're just clearing a date field. Don't overthink it.