I have a domain (DC is running Windows Server 2008 R2) and have the Account Lockout Policy enabled. When a user attempts to log into their PC (with the correct password) they receive the following error:

The referenced account is currently locked out and may not be logged on to.

I have unlocked the account within AD and disabled the account lockout policy (which has temporarily resolved this issue).

What could be causing this issue?

  • Did this user have any failed attempts? What was your policy set to (how many attempts before the account locks out)? – user95923 Jan 7 '14 at 21:16
  • No. the user has not any attempts. he/she locked for no reason. and the policy for account security is the default policies. – Ahmad Jan 8 '14 at 11:47
  • How many domain controllers do you have? What is the client OS being used by the user? – user226159 Jun 13 '14 at 13:15

If the user has recently changed their password, this could be something trying to authenticate using the old password.

I'd suggest using Account Lockout and Management Tools (click here for the instructions on using the Account Lockout and Management Tools) by Microsoft to trace where the account is being locked out; this will help determine the cause.

Alternatively, if you update the post with the logs from your DC, I can attempt to trace it from there.

| improve this answer | |
  • I think the bigger issue here is that the OP thinks they've disabled Account Lockout in their Domain Security Policy but, clearly, they haven't. – Evan Anderson Jan 9 '14 at 20:02
  • I think the OP disabled the Account Lockout GPO due to this issue (as a temporary fix) and this has resolved the issue... But it's very vague. – user95923 Jan 11 '14 at 21:14
  • That it is. I somehow think we'll never know... – Evan Anderson Jan 11 '14 at 21:19

I know you've disabled the policy for mistypes but I'm curious, does the user have a mobile device connected their account? If that is the case, then the user needs to check that their passwords are updated correctly on their devices otherwise this can also cause a lockout on the machine.

| improve this answer | |
  • No. The user just work on a single PC and don't have any Mobile Device. – Ahmad Jan 9 '14 at 5:17
  • 1
    do you also include RDP sessions on remote hosts? I've been caught out when an RDP login didn't exit properly, but was caching credentials. – Sobrique Jun 13 '14 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.