Quick answer
You unlock a locked AD account in Active Directory Users and Computers (ADUC): find the user, right-click and select "Unlock Account". If you don't have ADUC, use the PowerShell command `Unlock-ADAccount -Identity username`. Always first check the source of failed logins (cached credentials, services, mobile devices) so the account doesn't get locked again.
How to recognize the problem
- User cannot log in to the Windows domain, message that the account is locked.
- Failed login to Exchange or Microsoft 365 with a message about locked account.
- VPN or RDP login rejects domain credentials.
- Event Viewer on the domain controller shows event 4740 (account locked).
- User claims they entered the password correctly, but the account still gets locked.
Most common causes
Wrong password multiple times
User or application enters the wrong password as many times as defined by the lockout policy (e.g. 5 times), so the account automatically locks.
Cached credentials on devices
Old devices, network drives or services using old passwords still try to log in, causing re-locking.
Account lockout policy
GPO or local policy defines a low attempt threshold and short lockout duration, so the account easily locks.
Service accounts with expired password
Applications, scripts or services using domain accounts with wrong or expired password can lock the account.
Step-by-step fix
- 1
Unlock the account in ADUC
On the domain controller or a computer with RSAT tools installed, open
Active Directory Users and Computers. Find the user (right-click on domain >Find...), right-click on the account and selectUnlock Account. The account is unlocked immediately. - 2
Unlock the account via PowerShell
If you don't have ADUC, on a computer with RSAT tools for Active Directory installed, run Windows PowerShell as administrator and import the module:
Import-Module ActiveDirectory. Then executeUnlock-ADAccount -Identity username. Check the status with the commandGet-ADUser username -Properties LockedOut | Select-Object Name, LockedOut. - 3
Check who caused the lockout
On the domain controller open
Event Viewer>Windows Logs>Securityand filter event ID 4740. In the details look at theCaller Computer Namefield to identify the device or server that caused the lockout. - 4
Reset the password if needed
If the user doesn't know the password, in ADUC right-click on the account >
Reset Password.... CheckUser must change password at next logonand give the temporary password to the user securely. - 5
Clear cached credentials
On the user's computer open
Control Panel>Credential Managerand remove old entries for the domain. Then inCommand Promptrunklist purgeto delete Kerberos tickets, then restart the computer. - 6
Update passwords in services
Check services, scheduled tasks and applications that use domain accounts. Update the password in their settings or, if possible, switch to
Group Managed Service Account(gMSA) to avoid manual updates. - 7
Check the lockout policy
In
Group Policy Managementopen the GPO containingAccount Lockout Policy(Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Account Lockout Policy). AdjustAccount lockout threshold,Account lockout durationandReset account lockout counter afteraccording to organizational needs. Note that a value of 0 forAccount lockout thresholddisables account lockout. - 8
Test login
Ask the user to log in to the domain again. Check if event 4740 appears again in Event Viewer. If lockout repeats, repeat step 3 and find the source.
If the account still gets locked
If the account gets locked again after unlocking, there is probably a source of failed logins. Use an account lockout tracking tool, for example Microsoft Account Lockout Status, or a suitable solution that monitors events on all domain controllers. Also check mobile devices (phones, tablets) that have email or VPN configured with an old password. On the domain controller review events 4625 (failed login) and 4771 (Kerberos failure) to identify the source. If the problem persists, contact the domain administrator or IT support.
How to prevent it
- Regularly update passwords on all devices and services that use domain accounts.
- Use `Group Managed Service Account` (gMSA) for services instead of regular user accounts.
- Set the lockout policy with a reasonable threshold (e.g. 10 attempts) and duration.
- Clear cached credentials on computers when changing passwords.
When to call a professional
If you don't have access to the domain controller or cannot identify the source of the lockout, contact IT support or the domain administrator.
IT infrastructure maintenance · Servers, networks, backup, security and helpdeskFAQ
How do I know which device is locking the account?
On the domain controller open Event Viewer > Windows Logs > Security and find event ID 4740. In the details look at the `Caller Computer Name` field.
Can I unlock the account without administrator rights?
No, unlocking requires membership in the `Domain Admins` group or delegated control over the OU where the account is located.
Why does the account get locked again immediately after unlocking?
Most often due to cached credentials on devices or services using an old password. Check Event Viewer and clear cached credentials.