| Previous | Next |
| STATUS_NETLOGON_NOT_STARTED | STATUS_POSSIBLE_DEADLOCK |
STATUS_ACCOUNT_EXPIRED
Different from an expired password
STATUS_ACCOUNT_EXPIRED means the account’s validity period has ended. Unlike a password-expired result, changing the current password is not necessarily sufficient because the directory has placed the identity outside its allowed lifetime. This is common for temporary staff, contractors, test accounts, migration identities and access that was intentionally granted only until a fixed date.
It is important not to conflate account expiry with disablement or lockout. All three prevent sign-in, yet they express different governance decisions: expiry is a scheduled end date, disablement is an explicit state, and lockout is a response to failed authentication. The right remediation is therefore to review the account’s intended lifecycle and approval record.
What to verify
- Inspect the account expiry setting at the authoritative identity provider and confirm the timezone and policy context.
- Confirm whether the account should be extended, replaced, or retired; do not automatically reactivate temporary identities.
- Check dependent workloads for a planned account rotation or a forgotten service credential.
- After any authorised extension, validate only the intended access path and retain an audit trail for the lifecycle decision.
References
- Microsoft Open Specifications: NTSTATUS reference
- Microsoft: Event 4769, Kerberos service-ticket auditing
- NIST SP 800-63B digital identity guidance
Looking for a different code? Search another status or error code.