Fix 0X000008BF User Account Expired Error

You're sitting at a Windows 10 or Server 2016+ box, credentials are correct, but login bounces back with 0X000008BF and a message that boils down to "this user account has expired." This almost always hits in two scenarios: a local account where someone (or some script) set an expiration date months ago, or a domain account where the admin set an account expiry and forgot about it. It's not a password issue, not a lockout, not a permission problem. The account itself is time-boxed and the clock ran out.

The root cause is dead simple: Windows checks the accountExpires attribute on the user object. For local accounts, that's stored in SAM; for domain accounts, it's in Active Directory. When the current date is past that value, the system refuses login with this exact error. The fix is equally simple — clear that expiry or set it to never. I've fixed this more times than I can count, and nine out of ten it's a local account that got a temporary expiry for a contractor or temp and nobody extended it.

Fix It: Clear the Account Expiry

You'll need admin rights. If you're locked out of the box entirely, boot to Safe Mode with Command Prompt or use another admin account. Here's the straightforward path.

Identify the account. If you're in a domain, check with Get-ADUser -Identity username -Properties AccountExpirationDate in PowerShell. For local, skip to step 2 — it's faster.
Open an elevated Command Prompt. Right-click Command Prompt, run as administrator.
Run the net user command. For a local account, type:
```
net user <username> /expires:never
```
Replace <username> with the actual login name. This clears the expiry immediately.
For domain accounts, use PowerShell on a domain controller or RSAT machine:
```
Set-ADUser -Identity <username> -AccountExpirationDate $null
```
That wipes the expiry. Then verify with Get-ADUser -Identity <username> -Properties AccountExpirationDate — should show blank.

If you'd rather click than type, go to Computer Management → Local Users and Groups → Users, double-click the user, and on the General tab you'll see an "Account expires" section. Set it to "Never". For domain users, Active Directory Users and Computers (ADUC) → Account tab → Account expires → Never. That's the GUI route, but honestly the command line is faster and less clicking around in a panic.

What If It Still Fails?

If you cleared the expiry and the error persists, you're looking at something else. First, double-check the date and time on the machine. If the system clock is off by a few years, Windows thinks it's still past the expiry. Sync with time.windows.com or your domain's NTP server. I've seen this once — a server BIOS battery died, clock jumped to 2035, and everyone's account looked expired.

Second, for domain accounts, replication delays. You cleared it on one DC, but the DC you're authenticating against hasn't gotten the update. Force replication or just wait a few minutes — repadmin /syncall if you're impatient.

Third, group policy can force an expiry even if the user attribute is clear. Check gpedit.msc → Computer Config → Windows Settings → Security Settings → Local Policies → Security Options → Interactive logon: Machine account lockout threshold. No wait, that's for lockouts, not expiry. Actually, check if there's a fine-grained password policy (PSO) in AD that sets an account expiry — rare, but it exists. In most cases, clearing the attribute does it.

Last resort: if it's a local account and you can't get in at all, reset the password via net user <username> * from Safe Mode. That won't clear the expiry, but it tells you if the issue is truly the expiry or something else.

One more thing — if you're on a domain and this is a service account, don't just set it to never. Some organizations have a policy against non-expiring service accounts. Create a reminder to re-up it every year. But that's a security team problem, not a technical one. For the immediate fix, you're done.