| Previous | Next |
| ERROR_NETLOGON_NOT_STARTED | ERROR_REDIRECTOR_HAS_OPEN_HANDLES |
ERROR_ACCOUNT_EXPIRED
The account is expired, even if its password is still valid.
ERROR_ACCOUNT_EXPIRED is Win32 error 1793 (0x701). Active Directory and other Windows account stores can assign an account expiration time independent of password expiration, disablement, lockout, and logon-hour restrictions. Once that boundary is reached, new authentication is denied. Existing sessions or cached credentials can make the condition appear inconsistent until they are renewed.
Why an account reaches this state
- a temporary employee, contractor, test, or service account had a planned end date
- automation calculated the date in the wrong time zone or used an unintended default
- an account was copied from a template that already contained an expiration value
- identity-governance synchronization applied or failed to clear a lifecycle date
- operators confuse account expiration with password expiration and reset the wrong property
Identity evidence to record
Capture account identity, directory and domain, accountExpires value converted with explicit time zone, current domain-controller time, account enabled and locked state, password-expiry status, source identity system, last policy change and actor, logon type, and domain controller returning 1793. Avoid exposing unnecessary personal details in application logs.
How to verify the decision
Read the account expiration property from an authoritative directory controller and compare it with that controller’s current time. Check replication when different controllers disagree. Verify that the application is authenticating the intended account rather than a same-named local or trusted-domain identity.
Separate lifecycle controls: enabled/disabled, account expiration, password expiration, lockout, logon hours, and workstation restrictions. Resetting a password does not extend account lifetime. For service identities, confirm whether interactive account-expiration policy is appropriate or whether a managed service account should be used.
Resolution
An authorized identity administrator can extend or clear the expiration date when business approval exists, then allow directory replication and start a fresh authentication session. If expiration was intentional, use a replacement approved identity rather than bypassing the control.
Provisioning systems should store the authoritative end date, handle time zones consistently, notify owners before expiration, and remove obsolete exceptions. Applications should display “account expired” distinctly from “wrong password” without revealing sensitive directory details to anonymous clients.
Difference from password expiration
Password expiration requires changing the credential while the account remains valid. Account expiration ends the account’s permitted lifetime. ERROR_ACCOUNT_DISABLED is an administrative state without necessarily involving a date, and lockout usually follows authentication failures.
Example
A scheduled report stops on the first day of a new quarter with 1793. The password was rotated successfully, but the service account inherited a contractor template expiration date. Identity administrators approve an extension and migrate the job to a managed service account.
References
- Microsoft: System Error Codes (1700–3999)
- Microsoft: accountExpires attribute
- Microsoft: Set-ADAccountExpiration
Looking for a different code? Search another status or error code.