| Previous | Next |
| ERROR_PASSWORD_EXPIRED | ERROR_NONE_MAPPED |
ERROR_ACCOUNT_DISABLED
Authentication reached a valid principal, but the account is disabled
A disabled account remains a security principal with a SID and can still appear in ACLs, group membership, or historical audit records. Disabling the account prevents it from being used for normal logon; it does not delete the principal or erase its SID. That distinction matters when troubleshooting a service or scheduled process that can resolve the account name but receives an authentication failure.
Check the authoritative account state and security event 4625 before enabling anything. For domain principals, confirm the DC that processed the request and replication state if administrators recently changed the account. Also determine whether a service is still configured to run under a deliberately disabled identity. Re-enabling an account is a security-policy decision, not a generic error-recovery step; first identify why the account was disabled and whether a replacement service account or credential should be configured instead.
What to inspect
- Confirm the disabled flag in the authoritative local or domain account database.
- Correlate the failure with event 4625 and the DC that handled authentication.
- Identify services or scheduled tasks still configured to use the disabled principal.
References
- Microsoft: security event 4625
- Microsoft: Windows authentication credentials
- Microsoft: security identifiers
Looking for a different code? Search another status or error code.