Account Lockouts in Active Directory

Problem

A domain user account is locked out and the user cannot log in anywhere.

Symptoms

• "Account is locked" message at login
• Repeated failures across multiple systems for the same account
• Lockout recurs shortly after being unlocked

Possible Causes

• A cached old password retrying automatically on a phone, mapped drive, or scheduled task
• Genuine repeated incorrect password entry by the user
• A brute-force attempt against the account
• A service account with a password that changed but wasn't updated everywhere it's used

Diagnostic Steps

1. Check the account lockout status and the specific domain controller that recorded it
2. Check Event Viewer on that DC for event ID 4740 (account lockout) to see the source device
3. Ask the user if they recently changed their password and where it might be cached elsewhere

Commands & Tools

Step-by-Step Solution

1. Unlock the account (Unlock-ADAccount, or via AD Users and Computers)
2. Identify the source device from the lockout event and update the cached credential there (phone mail profile, mapped drive, scheduled task)
3. If lockouts recur immediately with no clear source, treat it as a potential brute-force attempt and involve security
4. For service accounts, update the password everywhere it's configured before considering it resolved

Verification

The account logs in successfully and stays unlocked for a full working session without recurrence.

Common Mistakes

• Unlocking repeatedly without ever finding the actual source device causing it
• Assuming it's always user error without checking the lockout event source
• Changing a service account password without updating every place it's used

Escalation Criteria

Prevention

Set reasonable lockout thresholds, audit scheduled tasks and mapped drives for stale credentials after password changes, and monitor for unusual lockout patterns.

Related Articles