| Previous | Next |
| ERROR_DOMAIN_CONTROLLER_NOT_FOUND | OR_INVALID_OXID |
ERROR_ACCOUNT_LOCKED_OUT
The account is locked and cannot sign in.
ERROR_ACCOUNT_LOCKED_OUT is Win32 error 1909 (0x775). Lockout is a policy state usually reached after repeated failed authentication, although administrative action and directory state can also affect it. The code identifies the account state at the authenticating authority; it does not reveal which device or process submitted the bad credentials that caused the lockout.
Common lockout sources
- a user repeatedly enters an old or mistyped password
- a service, scheduled task, mapped drive, mobile device, or saved credential keeps retrying a stale password
- multiple applications share one account and one instance was not updated after password rotation
- an exposed authentication endpoint is receiving password-guessing attempts
- replication timing or contacting different controllers makes lockout state appear inconsistent briefly
Security evidence to preserve
Record the account SID, authenticating domain controller, source workstation or IP where available, logon type, authentication package, failure timestamps, lockout threshold and duration, caller process, and correlated Security events. Never log attempted passwords or reusable authentication material. Preserve enough event history to identify the first bad-password source, not only the later applications observing 1909.
How to find the cause
Confirm lockout state on the authoritative domain and identify the controller that processed the threshold-crossing attempt. Correlate bad-password and lockout events by account, source, and time. Search services, tasks, applications, credential manager, mobile clients, and scripts on the source device for stored credentials.
Treat unexpected external sources as a security incident. If the user reports no failed attempts, investigate credential abuse before unlocking. Check replication health when controllers disagree, but do not repeatedly reset the password while an unknown retry source remains active.
Recovery and prevention
Stop or update the stale credential source, then unlock the account through approved administrative or self-service procedures. A password reset may be appropriate after suspected compromise, but all dependent credentials must be updated to prevent immediate relock.
Use managed service accounts for services, unique identities for separate workloads, bounded retry logic, and monitoring that identifies recurrent source devices. Applications should stop rapid retries when they receive 1909 and tell the user the account is locked without disclosing policy details to unauthenticated clients.
Difference from a required password change
ERROR_PASSWORD_MUST_CHANGE asks the legitimate user to replace a temporary or expired password. Error 1909 blocks sign-in because lockout policy is active; changing the password without removing the retry source may not prevent another lockout.
Example
A scheduled task on an old server retains a former password and runs every minute. The user account repeatedly locks, and new interactive logons receive 1909. Disabling the task, updating it to a managed service account, and then unlocking the user ends the cycle.
References
- Microsoft: System Error Codes (1700–3999)
- Microsoft: Win32 Error Codes in MS-ERREF
- Microsoft: Account lockout policy
- Microsoft: Account lockout troubleshooting
Looking for a different code? Search another status or error code.