guidox / Security
Check **net accounts** for the lockout threshold, find event **4625** for the source, then clear the lock with **net user <name> /active:yes** or by resetting the lockout counter.
A locked account cannot unlock itself. Use a second admin account, or the built-in Administrator in safe mode when no other admin exists.
whoami
whoami /groups | Select-String -Pattern 'S-1-5-32-544'
Get-LocalUser | Select-Object Name,Enabled,LockedOut,LastLogon**net accounts** prints the threshold, the duration and the observation window. A threshold of 10 with a 10-minute duration is the default on a standalone machine.
net accounts
Get-LocalUser bob | Select-Object Name,LockedOut,PasswordExpires,PasswordLastSet
secedit /export /cfg C:\temp\acct.inf /areas SECURITYPOLICY; Select-String -Path C:\temp\acct.inf -Pattern 'LockoutBadCount|ResetLockoutCount|LockoutDuration'**/active:yes** re-enables a disabled or locked account. If the account is only counted out, a successful sign-in after the duration clears it as well.
net user bob /active:yes
Get-LocalUser bob | Select-Object Name,Enabled,LockedOut
Unlock-LocalUser -Name bob -ErrorAction SilentlyContinue
net user bob | Select-String -Pattern 'Account active|Lockout'Repeated 4625 events with a wrong password are not always the user. A scheduled task, a mapped drive or a phone with a stale password keeps retrying.
Get-WinEvent -LogName Security -MaxEvents 500 | Where-Object Id -in 4625,4740 | Select-Object TimeCreated,Id,Message -First 5
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740} -MaxEvents 5 -ErrorAction SilentlyContinue | Select-Object TimeCreated,MessageA saved credential in Credential Manager or a mapped drive with the old password keeps the loop alive. Removing that entry is the real fix.
cmdkey /list
Get-SmbMapping | Select-Object LocalPath,RemotePath,Status
Get-ScheduledTask | Where-Object Principal -like '*bob*' | Select-Object TaskName,TaskPath,StateA very low threshold locks people out of their own machine. Raise the threshold or shorten the duration instead of disabling the lockout entirely.
net accounts /lockoutthreshold:10 /lockoutduration:15 /lockoutwindow:15
net accounts
Get-LocalUser bob | Select-Object Name,Enabled,LockedOutThe shell is not elevated, or the account is a domain account. Domain lockouts are cleared on the domain controller, not locally.
Something retries the wrong password within seconds. Watch the 4625 events for the caller computer name and the logon type.
Boot into safe mode, where the built-in Administrator is available, unlock the account, then create a second admin.
That is a different state. Enable it with net user <name> /active:yes and check the 4725 event for who disabled it.
No. The password stays; only the sign-in is blocked for the lockout duration.
The sign-in screen shows the same error for a wrong password and a locked account. The event log is the reliable source.
A PIN failure counts against the account in most configurations. The 4625 event shows the logon type, which distinguishes them.
If you changed the policy, restore the previous values with net accounts. Unlocking an account is not a persistent change.
Free · no account needed · tracks your progress