| Previous | Next |
| STATUS_PASSWORD_EXPIRED | STATUS_NONE_MAPPED |
STATUS_ACCOUNT_DISABLED
Identity found, access deliberately unavailable
STATUS_ACCOUNT_DISABLED is an account-state result, not a password-verification result. The directory can locate the identity, but the account is marked disabled and is not allowed to complete the requested authentication. This commonly appears after deprovisioning, security containment, account staging, or an administrative action; it can also be confused with a credential problem when the application shows only a generic sign-in message.
Kerberos auditing treats disabled, expired and locked-out identities as related account restrictions, but they require different remediation. Re-enabling an account is a security decision: it should follow the organisation’s ownership, access-review and incident-response process rather than be treated as a local client fix.
Useful verification steps
- Confirm the account’s authoritative directory and whether the disabled state is expected for its lifecycle stage.
- Review recent account-management and sign-in events before changing the state.
- Check that the application is not accidentally using a disabled duplicate, obsolete service account or an account from the wrong domain.
- After authorised re-enablement, test the intended sign-in method and ensure stale credentials do not keep generating failures.
References
- Microsoft Open Specifications: NTSTATUS reference
- Microsoft: Event 4768, Kerberos TGT request auditing
- NIST SP 800-63B digital identity guidance
Looking for a different code? Search another status or error code.