Fix Referenced Account Locked Out Windows

If Windows says your account is locked out and references another account or domain, the fix is to wait for the lockout timer to expire (usually 10–15 minutes) or have an administrator unlock it via Active Directory or Local Users and Groups. For a local account, you can also boot into Safe Mode and use the built-in Administrator account to reset the password. Below is a complete guide covering causes, step-by-step fixes, and prevention.

Why Windows Locks an Account

Windows locks an account after a set number of failed sign-in attempts. This is controlled by a Group Policy setting called Account Lockout Threshold. When the threshold is reached, the account is locked for a duration defined by Account Lockout Duration. The lockout is intended to stop brute-force password guessing, but it can also be triggered by a forgotten password, a saved credential that is outdated, or a scheduled task using old credentials.

On a domain-joined computer, the lockout is enforced by the domain controller, not the local machine. That is why the error often says “referenced account is currently locked out” – it means the domain controller has flagged the account as locked. On a standalone PC, the lockout is managed locally by Windows.

How to Check If Your Account Is Locked

Before attempting fixes, confirm the lockout status. On a domain, an administrator can open Active Directory Users and Computers, right-click the user, select Properties, and look at the Account tab. The “Account is locked out” checkbox will be checked. On a local machine, you can use the command prompt as an administrator:

Press Win + R, type cmd, and press Ctrl+Shift+Enter to run as administrator.
Type net user username (replace username with the account name) and press Enter.
Look for the line “Account active” – if it says No, the account is locked or disabled.

If the account is disabled, you will see “Account active No” but that is a separate setting from lockout. Lockout is shown as “Account locked out” in the output of net user on some systems, but not all. The most reliable way is to check the security event log (Event ID 4740 on domain controllers, or 4625 on local machines).

Step-by-Step Fixes for a Locked Account

Try these fixes in order. The first is the simplest and often works.

Wait 10–15 minutes. The default lockout duration is 30 minutes, but many administrators set it to 10 or 15. If you are not in a hurry, just wait and try again.
Use a different account. If you have another administrator account, log in with that and unlock the locked account via Computer Management → Local Users and Groups → Users. Right-click the user, select Properties, and uncheck “Account is locked out.”
Boot into Safe Mode. Restart the PC and press F8 (or Shift + Restart) to enter Safe Mode. In Safe Mode, the built-in Administrator account is often available. Log in with it and reset the password or unlock the account.
Use the command prompt from Windows Recovery Environment. If you cannot log in at all, boot from a Windows installation USB, go to Repair your computer → Troubleshoot → Advanced options → Command Prompt. Then use net user commands to unlock the account.
For domain accounts: Contact your IT administrator. They can unlock the account in Active Directory or reset the password. They can also check which computer or service is causing the lockouts.

Common Causes of Repeated Lockouts

If the account locks again shortly after unlocking, something is continuously trying to authenticate with old credentials. Common culprits:

Stored credentials in Windows Credential Manager. Go to Control Panel → Credential Manager → Windows Credentials and remove any entries for the affected account or server.
Mapped network drives. If you mapped a drive with a password that has changed, disconnect it and remap with the correct credentials.
Scheduled tasks. Check Task Scheduler for tasks that run with the locked account’s credentials. Update them or disable them.
Mobile devices and apps. Phones, tablets, or email clients that still have the old password will keep trying and lock the account again. Update credentials on all devices.
Services running as the user. Open Services (services.msc) and look for services that log on as the affected user. Change them to use a different account or update the password.

How to Prevent Future Lockouts

Prevention is better than repeated unlocking. Here are practical steps:

Use a password manager to avoid typos and forgotten passwords.
Update all saved credentials whenever you change your password – on every device.
Ask your administrator to set a higher lockout threshold (e.g., 10 attempts) and a shorter lockout duration (e.g., 10 minutes) if the policy allows.
Enable account lockout reset after a certain time – this is a domain policy setting that resets the failed attempt counter after a defined period.
Disable the lockout for local accounts if the machine is not shared and is physically secure. This is not recommended for domain accounts or laptops.

What to Do If You Cannot Unlock It Yourself

If you are not an administrator and do not have access to another admin account, you cannot unlock the account yourself. On a domain, you must contact your IT helpdesk. On a local machine, you may need to reset the PC (which removes accounts) or use a password reset disk if you created one earlier. For Microsoft accounts, you can reset the password online at account.live.com/password/reset, but that does not unlock the local account – it changes the password, which may clear the lockout if the lockout is tied to the password. However, if the account is locked due to too many attempts, changing the password online does not always unlock it immediately; you may still need to wait or use another admin account.

Frequently Asked Questions

How long does a Windows account lockout last?

It depends on the policy. The default in Windows is 30 minutes, but many administrators set it to 10 or 15 minutes. The exact duration is set in the Group Policy or Local Security Policy under Account Lockout Duration.

Can I unlock my account without an administrator?

No, not directly. You need another account with administrative privileges. If you have none, you can try Safe Mode with the built-in Administrator account (if it is enabled and has a known password). Otherwise, you must contact your IT administrator.

Why does my account keep locking even after I reset the password?

Because some device or service still has the old password. Check Credential Manager, mapped drives, scheduled tasks, and mobile email apps. Each failed attempt from those sources will relock the account.

Does restarting the computer clear the lockout?

No. The lockout is stored on the domain controller (for domain accounts) or in the local SAM database. Restarting the PC does not reset the failed attempt counter or the lockout timer.

Is there a command to unlock a locked account?

Yes, as an administrator, you can run net user username /active:yes to re-enable an account, but that does not clear the lockout. To clear lockout, you must uncheck “Account is locked out” in the user properties, or use PowerShell: Set-ADAccountLockoutTime -Identity username -Reset on a domain controller.

What is the difference between a locked account and a disabled account?

A locked account is temporary and clears after the lockout duration or when an admin unlocks it. A disabled account is permanent until an admin re-enables it. The error messages may look similar, but the fix differs.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →