Skip to content

Windows Security: Unlock User Account

Quick Fix

Unlock the account now

  1. Open the VM Console in your Euronodes client panel (it always works, even if RDP is locked or blocked).
  2. Log in with an administrator account.
  3. Run this in PowerShell or CMD (as Administrator), replacing username: 
    net user username /active:yes
  4. Done. The account is unlocked. Test your login.

Prefer clicking? Use the GUI

  1. Press Win + R, type compmgmt.msc, press Enter
  2. Go to System Tools > Local Users and Groups > Users
  3. Right-click the locked user -> Properties
  4. Uncheck Account is locked out, click Apply

It will lock again unless you fix the cause

If the lockout came from a brute-force attack (the most common cause), unlocking only buys you a few hours before it locks again. See Stop It Happening Again below, or go straight to Secure Open RDP Access.

If All Accounts Are Locked

Safe Mode access

If no account works even from the console, boot into Safe Mode with Networking (restart the VM, press F8 during boot). The built-in Administrator account is usually available there. Unlock or reset from Computer Management, then reboot normally.

See also Reset Windows Password if you also need to reset the password.

Why Accounts Get Locked

Common causes

  • Brute-force attacks - Bots hammering an open RDP port with wrong passwords (by far the most common)
  • Service misconfigurations - A service or scheduled task still using an old password
  • Cached credentials - A phone, mapped drive, or RDP client saving an outdated password and retrying
  • User error - Repeatedly typing the wrong password

Investigate the Cause

Find who locked it (Event Viewer)

  1. Press Win + R, type eventvwr.msc, press Enter
  2. Go to Windows Logs > Security
  3. Filter for Event ID 4625 (failed logins)
  4. For each entry, check:
  5. Account name - which account was targeted
  6. Source IP / workstation - where the attempts came from
  7. Logon type - RDP (type 10/3), service, etc.

PowerShell shortcut

# Failed logins in the last 24 hours
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625; StartTime=(Get-Date).AddHours(-24)} |
    Format-Table TimeCreated, @{N='Account';E={$_.Properties[5].Value}}, @{N='SourceIP';E={$_.Properties[19].Value}}
Lots of attempts from external IPs = brute-force attack. A single internal IP = a saved/stale credential to fix.

Stop It Happening Again

Brute-force attack (external IPs in the logs)

The lockout is a symptom of an open RDP port. Fix the port, not just the account:

  • Restrict RDP to your IP, change the port, auto-block attackers, or use a VPN.
  • Full steps: Secure Open RDP Access.

Stale credential (one internal source IP)

  • Scheduled tasks - update stored credentials in Task Scheduler
  • Services - fix any service running under the locked account (services.msc)
  • IIS - check application pool identities
  • Mapped drives / saved RDP / phone email - clear the old saved password

Tune the Lockout Policy

Configure Account Lockout Policy

  1. Press Win + R, type gpedit.msc, press Enter
  2. Go to Computer Configuration > Windows Settings > Security Settings > Account Policies > Account Lockout Policy
  3. Reasonable values:
  4. Account lockout threshold: 10 attempts
  5. Account lockout duration: 15 minutes
  6. Reset counter after: 15 minutes

Lockout slows attackers but is not real protection. Restricting the port is. See Secure Open RDP Access.

FAQ

How long does a lockout last?

By default, until an admin unlocks it. With a lockout duration set, it clears automatically after that time (for example 15 minutes).

Why does it keep locking right after I unlock it?

The brute-force is still running against an open port. Unlocking is temporary. Lock down RDP: Secure Open RDP Access.

Why do service accounts lock so often?

A service or scheduled task is still using the old password after a change. Update the stored credentials wherever that account is used.

Can I disable lockouts entirely?

You can (set threshold to 0), but then brute-force has unlimited tries. Better to keep a sane lockout policy and restrict who can reach RDP.

Contact Support

Need help?

  • Locked out now: Use the VM Console, then run the Quick Fix above.
  • Ongoing attacks: Open a ticket with Event Viewer details (Event ID 4625) and the source IPs.

Related: Secure Open RDP Access | Reset Windows Password