How to Unlock a Locked User Account in Active Directory (ADUC, PowerShell, and Troubleshooting)

6.2K

Active Directory security policies lock a user account after a specified number of failed logon attempts. A locked account cannot be used to sign in to the domain for a certain period of time. Locking user accounts in Active Directory after incorrect password attempts helps prevent unauthorized access and protects against brute-force attacks. This article explains how to check account lockout policy settings in a domain, and how to find and unlock a user account in Active Directory.

User account lockout feature

The AD account lockout feature is available by default, but it is not enabled unless an account lockout threshold is configured in Group Policy. When enabled, AD automatically locks a user account after a specified number of failed logon attempts, and the following message will appear on the Windows login screen:

The referenced account is currently locked out and may not be logged on to.

Locked-out users cannot sign in to Windows until the lockout period expires or an administrator manually unlocks the account.

How to Manually Unlock Active Directory Users

Users with appropriate permissions (such as Domain Admins, Account Operators, or delegated helpdesk users) can manually unlock accounts.

This can be done using the graphical AD tools:

• Active Directory Users and Computers snap-in (ADUC)
• Active Directory Administrative Center (ADAC) snap-in
• LockoutStatus.exe tool from the Account Lockout and Management Toolset

Unlock a locked user account using ADUC

Open the ADUC snap-in (dsa.msc), go to the properties of the locked user account, and check the option ‘Unlock account. This account is currently locked out on this Active Directory Domain Controller‘.

Unlock a locked user account using ADAC

Alternatively, click the ‘Unlock account‘ button in the user properties in the ADAC (dsac.exe) snap-in.

LockoutStatus tool

Microsoft provides the LockoutStatus.exe troubleshooting tool, which helps you to identify locked accounts, review lockout info across DCs, and determine which DC processed the lockout event. You can download the latest version from Microsoft’s Account Lockout Status tool page.

Unlock a locked user account using PowerShell

An administrator can unlock a user from the command line by using the Unlock-ADAccount PowerShell cmdlet (requires PowerShell Active Directory module to be installed).

Check if the account is locked (Lockedout=True) and show the lockout time:

Get-ADUser -Identity bjackson -Properties LockedOut,lockoutTime,LastBadPasswordAttempt,badPwdCount |
Select-Object Name,LockedOut,badPwdCount,LastBadPasswordAttempt,@{n='lockoutTime';e={[DateTime]::FromFileTime($_.lockoutTime)}}

Check the last failed password attempt

Before unlocking an account, you may want to check when the last failed authentication attempt occurred. The LastBadPasswordAttempt property shows the time of the most recent failed authentication attempt. It is calculated from the Active Directory badPasswordTime attribute.

Run the following command:

Get-ADUser -Identity bjackson -Properties LockedOut,LastBadPasswordAttempt |
Select-Object Name,LockedOut,LastBadPasswordAttempt

Here is an example of output:

Name LockedOut LastBadPasswordAttempt
---- --------- ---------------------
bjackson True 7/21/2026 10:45:32 AM

This info can help you to determine if the lockout is caused by a current issue (for example, a user entering an incorrect password repeatedly) or by another device/service still using an outdated password.

Unlock user:

Unlock-ADAccount -Identity bjackson -Confirm

Or use the following syntax:

Get-ADUser -Identity bjackson | Unlock-ADAccount

The net user command can check whether an account is enabled/disabled (but it does not show the AD lockout state):

net user b.jackson /DOMAIN | find "active"

The command mentioned above only shows whether the account is enabled/disabled. It does not show or remove the AD lockout state.

To list all locked users in domain, run the command:

Search-ADAccount -LockedOut -UsersOnly |
Select-Object Name, SamAccountName, ObjectClass

To find the source of account lockouts, run the command:

Get-WinEvent -FilterHashtable @{
    LogName='Security'
    ID=4740
} | Select-Object TimeCreated, Message

Event ID 4740 is logged on the DC that processed the account lockout. The Caller Computer Name field helps identify the device that caused repeated failed logon attempts.

In a multi-domain-controller environment, you need to start troubleshooting from the PDC Emulator, because it receives bad password notifications from other DCs. To find the PDC Emulator, run the command:

netdom query fsmo

Now check Event ID 4740 on that DC.

Unlock all locked AD users at once:

Search-ADAccount -LockedOut -UsersOnly| Unlock-ADAccount

Here are the common reasons for repeated account lockouts:

• Saved credentials in Windows Credential Manager;
• Mobile devices with old passwords;
• Outlook profiles using outdated passwords;
• Scheduled tasks running under user accounts;
• Windows services configured with user credentials;
• Mapped network drives;
• VPN clients.

In hybrid identity environments, you should investigate Microsoft Entra ID sign-in logs and Conditional Access policies if lockouts are related to cloud authentication attempts.

Find and unlock multiple locked accounts using ADAC

The ADAC GUI can also be used to find and unlock multiple locked user accounts in the domain:

1. Click on an arrow button in the right top corner of console;
2. Click Add criteria and select “Users with enabled but locked accounts”;
3. Click Add > Search;
4. A list of all locked user accounts will appear in the console. You can select them all, open Properties, and unlock all users at once by clicking Unlock account.

   

Check Account Lockout Policy Settings in AD

User lockout rules are defined in the account lockout policy settings in Active Directory. By default, these settings are defined in the Group Policy object named ‘Default Domain Policy’.

To quickly list the default account lockout settings that are configured in the Default Domain Policy, use this PowerShell command:

Get-ADDefaultDomainPasswordPolicy| select LockoutDuration, LockoutObservationWindow, LockoutThreshold

In this example, the account will be locked for 30 minutes (LockoutDuration) after 10 failed login attempts (LockoutThreshold).

Active Directory automatically unlocks the account after the LockoutDuration period expires, allowing the user to log on to the domain again. Or a domain administrator can manually unlock the user’s account immediately, so they don’t have to wait for the 30-minute lockout period to expire.

If the Fine-Grained Password Policy with custom account lockout settings is enabled for the user, you can check the resulting lockout policy settings for the target user:

Get-ADUserResultantPasswordPolicy -Identity j.brion | select-object LockoutDuration, LockoutObservationWindow, LockoutThreshold

The command mentioned above returns a policy only if a Fine-Grained Password Policy applies to the user. Otherwise, the Default Domain Password Policy is used.

Note. The PDC Emulator receives bad password notifications from other DCs and is usually the best starting point when investigating account lockouts. You can track user lockout events on the DC running the PDC Emulator FSMO role by the EventID 4740. For more information about, see our article on finding the source of user lockouts in AD.

Delegate Permission to Unlock Users in Active Directory

By default, only members of the built-in ‘Domain Admins’ and ‘Account Operators’ groups can remove user account locks in Active Directory. You can delegate unlock user permission to non-admin users (for example, to helpdesk team members).

1. Create a new AllowUnlockAccount security group in the domain;
2. Open the ADUC console and right-click on the users’ OU;
3. Select the item Delegate Control;
   

   

4. Click Add and select the AllowUnlockAccount group. Click Next;
5. Select Create a custom task to delegate > Only the following objects in the folder > User objects;
   

   

6. Select Property-specific and check two permissions in the list: Read lockoutTime and Write lockoutTime. These permissions allow changing the lockoutTime attribute, which is used by AD to manage account lockout status. Note that you should avoid granting broader permissions (such as Reset Password or Full Control) unless required.
   

   

7. Save the changes.

Members of the AllowUnlockAccount group can now unlock all user accounts in the target OU. Keep in mind tha the delegated permissions apply only to user objects inside the selected OU and its child containers where delegation was applied.

You can enable audit for accounts unlock events. To find out who has unlocked a specific user, you need to enable the Audit User Account Management policy for domain controllers (Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Account Management).

After updating the GPO, you can filter the Security Log by the Event ID 4767 (A user account was unlocked) to identify the user who unlocked the AD account.