Active Directory: Unlock or Reset a User Account

Category: Windows Server · Audience: Technicians · Est. time: 5–10 min

Summary

How to unlock a locked Active Directory account or reset a user's password on an on‑premises domain. This is a technician/admin task on a Domain Controller (or a machine with RSAT / AD Users and Computers).

⚠️ Verify identity first. Never unlock or reset an account for an unverified caller. Log the request in the ticket.

Unlock a locked account

1. Open Active Directory Users and Computers (dsa.msc).
2. Find the user (right‑click the domain → Find, type the name).
3. Right‑click the user → Properties → Account tab. If locked, you'll see "Unlock account" — tick it → OK. (In newer consoles: right‑click user → Unlock.)
4. Tell the user to try again. If it re‑locks quickly, a device has a stale saved password (see below).

Reset a password

1. In AD Users and Computers, right‑click the user → Reset Password.
2. Enter a strong temporary password, tick "User must change password at next logon" (best practice), untick "account is locked out" if shown → OK.
3. Provide the temporary password to the verified user via a secure channel.

Repeated lockouts (find the source)

A phone/mail app or mapped drive using an old password keeps locking the account.

1. On a DC, check Event Viewer → Security for Event ID 4740 (account locked) — it names the caller computer that triggered it.
2. Fix the offending device: update the saved password in the phone's mail app, Credential Manager, mapped drives, or scheduled tasks/services running as that user.

PowerShell (optional)

Unlock-ADAccount -Identity jsmith
Set-ADAccountPassword -Identity jsmith -Reset -NewPassword (Read-Host -AsSecureString)
Set-ADUser -Identity jsmith -ChangePasswordAtLogon $true

If that doesn't work

• Account disabled (not just locked)? Right‑click → Enable Account.
• Hybrid/Entra‑synced? A cloud sign‑in issue may need the Entra/M365 side too — escalate to BBN Support.

Prevention

• After any password reset, remind users to update the password on their phone and any saved logins to avoid immediate re‑lock.