How to Fix “The referenced account is currently locked out and may not be logged on to” in Windows

Quick Answer

If Windows shows “The referenced account is currently locked out and may not be logged on to”, the account has been locked by the local or domain account lockout policy after too many failed sign-in attempts. The fastest fix is to stop the device or app that is repeatedly using the wrong password, wait for the lockout duration to expire, or ask an administrator to unlock the account.

1. Stop repeated login attempts: disconnect old mapped drives, VPN clients, mail apps, RDP sessions, services, or scheduled tasks using the old password.
2. Wait for automatic unlock: many systems unlock after 15, 30, or 60 minutes depending on policy.
3. For domain accounts: ask a domain admin to unlock the account in Active Directory or PowerShell.
4. For local accounts: sign in with another administrator account, reset the password if needed, and review the local account lockout policy.
5. Clear saved credentials: remove outdated passwords from Windows Credential Manager.

Important: Do not keep trying random passwords. Each failed attempt can reset the lockout timer and make the problem last longer.

Problem

The error “The referenced account is currently locked out and may not be logged on to” usually appears when signing in to Windows, connecting over Remote Desktop, accessing a shared folder, or authenticating with a domain account.

You may see it in these situations:

• Windows 11 or Windows 10 sign-in screen
• Remote Desktop Connection
• Network share access, such as \\SERVER\Share
• Domain-joined computers
• Applications using Windows authentication

Cause

Windows locks an account when it detects too many failed password attempts within a configured time window. This is controlled by an account lockout policy. The failed attempts may come from you typing the wrong password, but they can also come from a background app or another device still using an old saved password.

Prerequisites

• Access to another administrator account, if fixing a local Windows account
• Domain administrator help, if the locked account belongs to Active Directory
• The correct current password for the account
• Access to Credential Manager, Services, Task Scheduler, or the affected device if saved credentials are causing lockouts

Step-by-step Solution

1. Stop signing in with the wrong password

First, stop repeated failed attempts. If you recently changed your password, check every device or app that may still be using the old one.

• Remote Desktop saved credentials
• Mapped network drives
• VPN clients
• Outlook or mail apps
• Mobile phones connected to work email
• Windows services running under your account
• Scheduled tasks using your account

On Windows, open Credential Manager and remove old entries:

1. Press Windows + R.
2. Type control keymgr.dll and press Enter.
3. Open Windows Credentials.
4. Remove saved credentials related to the locked account, server, VPN, RDP host, or domain resource.

2. Wait for the lockout duration to expire

If your organization uses an automatic unlock policy, the account may unlock after a set time. Common lockout durations are 15, 30, or 60 minutes.

Tip: Wait without retrying. A new failed attempt can restart the lockout timer.

3. Unlock a domain account in Active Directory

If this is a work, school, or domain account, a domain administrator can unlock it from Active Directory Users and Computers.

1. Open Active Directory Users and Computers.
2. Find the affected user account.
3. Right-click the account and select Properties.
4. Open the Account tab.
5. Check Unlock account, then click OK.

Administrators can also use PowerShell:

Import-Module ActiveDirectory
Unlock-ADAccount -Identity jsmith

To confirm whether the account is locked:

Get-ADUser -Identity jsmith -Properties LockedOut | Select-Object Name, LockedOut

4. Fix the issue for a local Windows account

If the locked account is a local Windows account, sign in with another administrator account on the same PC. Then check the local lockout policy.

1. Press Windows + R.
2. Type secpol.msc and press Enter.
3. Go to Account Policies > Account Lockout Policy.
4. Review Account lockout threshold and Account lockout duration.

You can also view local account policy from Command Prompt:

net accounts

If you forgot the password, reset it from another administrator account:

net user username newpassword

Replace username and newpassword with the correct values. Use a strong password and update it everywhere it is saved.

5. Remove stale mapped drives and network credentials

Old mapped drives are a common reason this error keeps coming back after you unlock the account. Remove disconnected or outdated mappings:

net use

net use * /delete

Then reconnect only the drives you need, using the current password.

6. Check services and scheduled tasks

If a Windows service or scheduled task runs under your user account with an old password, it can lock the account repeatedly.

Check Windows services:

1. Press Windows + R.
2. Type services.msc and press Enter.
3. Look for services using the affected account in the Log On As column.
4. Open the service properties and update the password on the Log On tab.

Check scheduled tasks:

1. Open Task Scheduler.
2. Review tasks that run under the locked account.
3. Update stored credentials or change the task to use a service account where appropriate.

Examples

Example 1: Error appears during Remote Desktop login

Clear saved RDP credentials, unlock the account, then connect again with the current password.

cmdkey /list

Delete a stored credential if it points to the RDP host:

cmdkey /delete:TERMSRV/servername

Example 2: Domain account locks again every few minutes

This usually means another device is still trying the old password. Check mobile email apps, VPN clients, mapped drives, and scheduled tasks. Domain admins can review Security event logs on the domain controller, especially lockout-related events such as 4740.

Common Causes

• Password recently changed but saved credentials were not updated
• Mapped network drive using an old password
• RDP client storing outdated credentials
• Mobile phone repeatedly syncing mail with an old password
• Windows service configured with a user account password
• Scheduled task running under an expired or changed password
• Too many manual sign-in attempts
• Account lockout policy set too aggressively

Common Mistakes

• Trying the same wrong password repeatedly
• Unlocking the account without finding the source of failed logins
• Ignoring phones, tablets, VPN apps, and saved RDP entries
• Disabling account lockout policy on business systems
• Resetting the password but not updating services or scheduled tasks

Best Practices

• Use a password manager to avoid typing mistakes
• Update saved credentials immediately after changing a password
• Use dedicated service accounts for services and scheduled tasks
• Enable account lockout policies, but choose reasonable thresholds
• Review domain controller lockout logs when accounts lock repeatedly
• Use multi-factor authentication where supported

Verification

After applying the fix, verify that the account is no longer locked and that failed attempts have stopped.

• Sign in once with the correct password
• Reconnect RDP or network shares manually
• Check Credential Manager for old saved passwords
• Run net use to confirm stale mapped drives are gone
• For AD accounts, confirm LockedOut is False

Get-ADUser -Identity jsmith -Properties LockedOut | Select-Object Name, LockedOut

If the account locks again soon after being unlocked, the password is still saved somewhere incorrectly. Start with Credential Manager, mobile devices, mapped drives, services, scheduled tasks, and VPN clients.

FAQ

What does “The referenced account is currently locked out and may not be logged on to” mean?

It means Windows or Active Directory has temporarily locked the account after too many failed sign-in attempts. The account cannot be used until it is unlocked or the lockout duration expires.

How long does a Windows account stay locked?

It depends on the configured account lockout policy. Many systems unlock after 15, 30, or 60 minutes, but some require an administrator to unlock the account manually.

Can I fix this without an administrator?

Sometimes. If the policy unlocks accounts automatically, wait for the lockout duration and then sign in with the correct password. If it is a domain or work account, you may need an administrator or help desk to unlock it.

Why does my account keep locking after I unlock it?

A device, app, mapped drive, service, scheduled task, VPN client, or RDP session is probably still trying to authenticate with an old password. Clear saved credentials and update the password everywhere it is stored.

Does resetting the password unlock the account?

Not always. In Active Directory, an administrator can reset the password and unlock the account, but both actions may be needed depending on policy and tools used.