How to Tell if Account Is Locked Active Directory
How to check if an AD account is locked out
(Last updated on June 8, 2021)
The Account Lockout Policy in Active Directory Group Policy sets the number of failed sign-in attempts before a user account is locked out. Once the account is locked out, it cannot be used (even with the correct password) until the account lockout duration has passed; or until an administrator manually unlocks the account. That's where you come in.
The Account Lockout Policy deters cybercriminals performing brute force attacks against Active Directory accounts, but this feature can cause a huge headache on a sysadmin and the IT team when an impatient end-user is looking for a workaround.
Below is an example of what an end-user sees when they're in the ALP lockout purgatory.
How can administrators check to see if an Active Directory account is locked out? In ADUC, navigate to the properties of the user, then the Account tab. You will see the following message if an account is locked out:
- Unlock account. This account is currently locked out on this Active Directory Domain Controller.
Administrators can also use PowerShell to query an Active Directory account, and check its status. You can use the following on a domain controller to check the properties of a user account.
Import-Module ActiveDirectory get-aduser -identity testuser -properties * | select accountexpirationdate, accountexpires, accountlockouttime, badlogoncount, padpwdcount, lastbadpasswordattempt, lastlogondate, lockedout, passwordexpired, passwordlastset, pwdlastset | format-list 
Unlocking Active Directory user accounts
The process of unlocking an account is straightforward. By default, there are two ways an account can unlock. This includes either administrator intervention, or waiting for the account lockout duration to expire.
An administrator can unlock the user account by either using the ADUC GUI, or PowerShell. Let's briefly look at both ways.
Using the ADUC snap-in, an administrator can place a check in the box next to the Unlock account. This account is currently locked out on this Active Directory Domain Controller checkbox.
This is easily accomplished using PowerShell as well. Administrators can use the following PowerShell cmdlet.
Unlock-ADAccount <username> 
Self-service account unlocks
With many organizations supporting remote employees, self-service workflows for end-users are hugely beneficial. Self-service solutions save IT time and money by reducing help desk tickets and prompt users to take ownership over their own password security and updates. Remote work as of late can increase the cached credential problem which means more lockouts and more helpdesk calls. Reliable self-service options will reduce this burden on your helpdesk.
Specops uReset is one great self-service option that allows end-users to perform everyday tasks related to password and account management in Active Directory.
Specops uReset is a self-service solution enables users to securely reset their Active Directory passwords. End-users can initiate the password reset process from any browser, their mobile device, or right from the Windows logon screen on their workstations. Specops uReset can notify an end-user when they're locked out and help unlock the account without a manual admin fix, saving you a ton of time and tickets. With a self-service solution like Specops uReset you don't have to identify or solve a locked account, the user can do it themselves.
Security features like multi-factor authentication and geo-blocking ensure that Specops uReset password reset solution is consistent with the high level of security you'd expect in your admin systems.
You can learn more about Specops uReset, and try it for free.
Brandon Lee
Brandon Lee has been in the industry 20+ years, is a prolific blogger focusing on networking, virtualization, storage, security & cloud, and contributes to the community through various blog posts and technical documentation primarily at Virtualizationhowto.com.
How to Tell if Account Is Locked Active Directory
Source: https://specopssoft.com/blog/how-to-check-if-an-ad-account-is-locked-out/
0 Response to "How to Tell if Account Is Locked Active Directory"
Post a Comment