I am having some issues on my domain with user accounts refusing to log in because the account is locked out, but in active directory (users and computers) the account is not marked as being locked out.

For example, this morning, a user phones in that her account is saying it's locked out. I go to remote desktop into the domain controller, but it's saying that my server admin account is locked out... so I log into the DC with my desktop account, open up the Users and Computers panel, browse first to my server admin account and it is NOT locked. Then I browse to the users account and.. it is NOT locked. I log out of the domain controller and try to remote desktop into it again with my server admin account and it works fine. And now the users account is working fine too.

For some reason, this happens very often and randomly. "X" account doesn't log into because it's "locked". Open up AD and find it is NOT locked, now "X" account is working. I have had times where all of my IT staffs desktops accounts and admin accounts are ALL locked out, users are getting notifications to log off/on to reauth their accounts, then, out of no where everything is working fine again.... none of the accounts are locked, etc..

I have not had much success in googling for solutions, so now I'm here. :(

My main question being... are there any scenarios where an "account is locked" error message is produced even though AD reports the account as unlocked?

And.. is there any way that accounts can be randomly locked and unlocked without admin intervention? (assuming the system/domain is not compromised)

A little about my AD: I have a main office (with 2 DCs) connected (via Cisco VPN) to 2 remote offices (each with own DC) on different subnets, defined in AD Sites. They all (4) appear to be replicating / otherwise functioning properly. I have not had a case of the above problem from any of the remote sites, only the main office.

  • 2
    As a side note: your "desktop" account having Administrative rights is a bad idea. Your "desktop" user account should be a standard user account just like everyone else. When you need to perform administrative tasks you should log on with the Administrator (or equivalent) account, perform the tasks, and log out. The bulk of your normal daily computing should be done with a standard user account. – joeqwerty Jun 13 '11 at 15:00
  • @Chris Allison - Can you provide a little info on your topology. Number of DC's, geographical seperation? – Patrick Jun 16 '12 at 18:51

I have not encountered any scenario where an account is listed as unlocked and the user is getting account locked issues. However, this could potentially occur if the DCs are not up to date.

Are the users who are getting this problem all within one AD site? Generally your intrasite DC replication will occur fast enough to avoid these issues. If your intersite replication schedule is too long and a user somehow gets locked in a separate AD site you could have the scenario you encounter.

Have you tried looking for the root cause of the account lockouts? You could use the Lockout Tool to find where the bad logon attempts are coming from.

  • +1. I suspect a replication issue as well. – joeqwerty Jun 13 '11 at 14:57
  • 1
    To add to that, check the account status when connected to your PDC Emulator. It should get notified immediately when a lockout occurs, regardless of site topology. – Shane Madden Jun 13 '11 at 16:45
  • Not sure if I agree with replication. OP states they attempted to logon to the DC and were reported as locked out. However if thats the case the LockOutstatus tool (microsoft.com/en-us/download/details.aspx?id=15201) will show all DC's in one go. Useful in these kinds of situations. – Patrick Jun 16 '12 at 18:46

I realize this is a few years old, but I come across this problem a lot at work with our DCs running Server 2003. I've found that if I manually disable the AD account and then re-enable it, it clears whatever hidden flag is tripping the locked message.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.