Home · Lessons

Account triage

How to unlock an Active Directory account

A user is locked out and can't sign in. Find the lockout, unlock the account with PowerShell, and confirm they can get back in. Here's the process help desk teams use.

1. Confirm who you are unlocking

Before you change anything, check the request against the user's identity. Two people can share a name, so use the username from the ticket, not just the display name. Unlocking the wrong account is a common mistake, and it can leave the real user locked out while the wrong account changes.

2. Check the lockout

Look up the account by username and check that the name matches the ticket. A name search can return more than one person, as it does for "Maria Santos" in the lab, so don't pick one by display name alone.

Get-ADUser -Identity msantos

To find every locked account in the directory, which is useful when several users report the same problem:

Search-ADAccount -LockedOut

3. Unlock the account

Pipe the user to Unlock-ADAccount. The cmdlet clears the lock, but it doesn't change the password.

Get-ADUser -Identity msantos | Unlock-ADAccount

4. Don't stop at the unlock

An unlock is only half the job. If the lockout keeps happening, the account will lock again within minutes. Ask yourself why it locked:

• A saved password on an old phone or mail client is still trying the old credentials.
• A service or scheduled task is using the user's account with a stale password.
• The password was recently reset, and the user is still typing the old one.

Check the source before you close the ticket, and write it down in the notes.

5. Confirm and close

Ask the user to sign in, or check that the lockout count is back to zero. Then record what you did: which account, when it was unlocked, and the likely cause.