Fix Referenced Account Is Currently Locked Out in Windows 11

If you see “The referenced account is currently locked out” when signing into Windows 11, the fix is to wait for the lockout timer to expire or reset the account through another admin account. This error appears when Windows security policy locks an account after too many failed sign-in attempts, and it can affect local accounts, Microsoft accounts, and domain accounts.

What Causes This Lockout Error?

Windows 11 has a built-in security feature called Account Lockout Policy. It is designed to prevent brute-force attacks, where someone tries many passwords in a row. When you enter the wrong password too many times, Windows locks the account for a set period. The default threshold is 10 failed attempts, and the lockout duration is 10 minutes, but a domain administrator or local security policy can change these numbers.

The lockout can also happen if you have a saved credential that is wrong, a scheduled task that uses an old password, or a background service trying to authenticate with bad credentials. Sometimes the lockout is not from a person at all—it can be triggered by a misconfigured app or a network drive that keeps trying a stale password.

How to Check Your Account Lockout Policy

Before you can fix the lockout, you need to know the exact settings. On a standalone Windows 11 PC, open the Local Security Policy editor:

Press Win + R, type secpol.msc, and press Enter.
Go to Account Policies > Account Lockout Policy.
Look at three values: Account lockout threshold (how many bad attempts), Account lockout duration (how long the lock lasts), and Reset account lockout counter after (how long before the counter resets).

If you are on a domain, these settings come from Group Policy. You can run gpresult /h policy.html in Command Prompt to see the effective policy, but the simplest path is to ask your IT administrator to check the domain policy.

How to Fix the Lockout (Step-by-Step)

The fix depends on whether you have another admin account on the PC. Here are the main methods:

Method 1: Wait It Out

If the lockout duration is set to 10 minutes (the default), just wait 10 minutes and try again. But note that the counter resets only after the duration, so if you try again too soon, you may extend the lock.

Method 2: Use Another Administrator Account

If you have a second admin account (like a local “Administrator” account or another user with admin rights), log in with that account and reset the locked account’s password:

Press Win + X and select Computer Management.
Go to Local Users and Groups > Users.
Right-click the locked account and select Set Password.
Set a new password, then log out and log in with that account.

This clears the lockout because the account is no longer in a locked state after a password reset.

Method 3: Use Safe Mode with the Built-in Administrator

If you don’t have another admin account, you can boot into Safe Mode. The built-in Administrator account is often disabled by default, but you can enable it from the recovery environment:

Restart your PC and interrupt the boot process three times (turn it off when the Windows logo appears) to trigger Automatic Repair.
Go to Advanced options > Troubleshoot > Advanced options > Startup Settings > Restart.
Press 4 or F4 to boot into Safe Mode.
Log in with the built-in Administrator account (it may have no password).
Open Command Prompt as admin and run: net user <username> /active:yes to enable the account, then net user <username> * to set a new password.

Method 4: Use the Command Line from Recovery

If you cannot log in at all, you can use the Command Prompt from the Windows Recovery Environment to enable the built-in Administrator and reset the lockout:

Boot from a Windows 11 installation USB or enter recovery as above.
Open Command Prompt from Advanced options.
Type regedit and press Enter. In the registry editor, highlight HKEY_LOCAL_MACHINE, then click File > Load Hive.
Navigate to C:\Windows\System32\config\SAM and load it as a hive name (e.g., temp).
Go to HKEY_LOCAL_MACHINE\temp\SAM\Domains\Account\Users\00000409 (the built-in Administrator’s RID is 500, but the key is 00000409).
Find the value F and double-click it. Look at the 38th byte (the 38th hex pair) and change it from 11 to 10 to enable the account. Then unload the hive and restart.

This is advanced and risky; only do it if you are comfortable editing the registry.

Common Problems and Misconceptions

One common misconception is that the lockout is permanent. It is not—it is a timed lock, unless an administrator has set the duration to 0, which means the account is locked until an admin unlocks it. If you see the error immediately after a reboot, it may be because a service is trying to log on with a cached password that is wrong. In that case, the lockout may keep happening even after you reset the password. To stop it, check the Event Viewer for lockout source:

Open Event Viewer (eventvwr.msc).
Go to Windows Logs > Security.
Look for Event ID 4740 (account locked out). It shows the caller computer name and the account that triggered the lock.

If the caller is a different computer, that machine has a scheduled task or service using your credentials. Fix that on the source machine.

How to Prevent Future Lockouts

To avoid this error in the future:

Use a password manager to avoid typos.
Check for saved credentials in Credential Manager (control /name Microsoft.CredentialManager) and remove any stale entries.
If you use a Microsoft account, consider switching to a PIN or Windows Hello, which are not subject to the same lockout policy.
If you are an administrator, adjust the Account Lockout Policy to a higher threshold (e.g., 20 attempts) or a shorter duration (e.g., 5 minutes) to reduce inconvenience.

What About Domain Accounts?

If you are on a corporate network, the lockout is often controlled by Active Directory. The default domain policy may lock after 5 bad attempts for 30 minutes. You cannot change that from your PC. Contact your IT helpdesk—they can unlock your account from Active Directory Users and Computers. They can also see which computer is causing the lockout using the net user <username> /domain command, which shows the last bad password attempt and the workstation name.

Frequently Asked Questions

How long does the lockout last in Windows 11?

The default is 10 minutes, but it can be set to any value by an administrator. If you see the error, wait at least 10 minutes before trying again. If it persists, check the policy with secpol.msc.

Can I unlock my account without another admin?

Yes, if you have access to the recovery environment. You can enable the built-in Administrator account and reset the password. However, if the built-in Administrator is also locked, you may need to use a Windows installation USB to access the registry and clear the lockout flag.

Does this error appear for Microsoft accounts?

Yes, but Microsoft accounts are locked by Microsoft’s own policy, not the local policy. You may need to wait 15-30 minutes or reset your password online. The local lockout policy still applies to the cached credentials on your PC.

Why does my account keep locking even after I reset the password?

This usually means another device or service is using your old password. Check Event Viewer for the caller computer name, and update any scheduled tasks, mapped drives, or phone apps that may be trying to authenticate.

Is there a way to see how many attempts I have left?

No, Windows does not show the remaining attempts. You only see the lockout message after the threshold is reached. You can check the security log for Event ID 4771 (Kerberos pre-authentication failed) to see failed attempts, but that is not user-friendly.

Will resetting my PC fix the lockout?

Resetting the PC (removing everything) will clear the local account lockout, but it is a drastic step. It will not help if the lockout is on a Microsoft account or a domain account. Try the simpler methods first.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →