| Previous | Next |
| STATUS_DOMAIN_CONTROLLER_NOT_FOUND | STATUS_HANDLE_NOT_CLOSABLE |
STATUS_ACCOUNT_LOCKED_OUT
A lockout is both a security control and a diagnostic clue
STATUS_ACCOUNT_LOCKED_OUT means that the account crossed a policy threshold for unsuccessful authentication attempts or password-change attempts. The restriction is intended to slow password guessing, but it can also be triggered by a legitimate device, service, scheduled task, mapped drive or application that continues using an old secret. Unlocking the account without finding that source often produces an immediate repeat lockout.
Lockout policy is a deliberate trade-off: Microsoft and MIT Kerberos documentation both note that thresholds can reduce brute-force attempts while also creating a denial-of-service risk when attackers or stale clients repeatedly submit failures. The status therefore warrants an evidence-first response rather than a blind reset.
Investigation order
- Collect the time window, source workstation or IP, logon type, authentication package and failure substatus from the relevant audit records.
- Check services, scheduled tasks, mobile devices, saved credentials and delegated jobs that may retain an older password.
- Review the effective lockout threshold, observation window and duration at the authority that owns the account.
- Unlock or reset only after the recurring source has been corrected, then monitor for a new failure burst.
References
- Microsoft Open Specifications: NTSTATUS reference
- Microsoft: account lockout threshold guidance
- MIT Kerberos: account lockout
- NIST SP 800-63B digital identity guidance
Looking for a different code? Search another status or error code.