"Sir, password is not working." That one sentence hides four completely different problems, each with a different fix. Windows actually tells you which one it is — in the exact wording of the message, if you know how to read it.
Support work gets faster the day you stop treating every sign-in failure as a generic password problem. A locked account, a disabled account, an expired password and a simply wrong password produce four different messages, are recorded with four different codes, and need four different responses — one of which is: do nothing, it fixes itself. This page lines the messages up side by side so you can identify each on sight, and adds the Event 4625 status codes admins use when the user cannot (or will not) read the message out accurately.
The referenced account is currently locked out and may not be logged on to.
Your account has been disabled. Please see your system administrator.
Message: "The referenced account is currently locked out and may not be logged on to." Cause: too many failed attempts inside the policy window. Owner of the fix: time, or an admin. The password itself is probably fine — the account is benched. The user should stop trying (extra attempts during the lock achieve nothing), and either wait out the duration or get an admin unlock. In the Security log this state appears as Event 4740 at lock time, and failed attempts against the already-locked account show sub-status 0xC0000234. Confusing lockout with a forgotten password leads to pointless resets — and a user who then mistypes the "new" password under pressure locks straight back out.
Message: "The user name or password is incorrect. Try again." Cause: exactly what it says — this attempt did not match. Event 4625 records it with sub-status 0xC000006A (bad password for a real account) or 0xC0000064 (the username itself does not exist — watch for typos in the account name, not the password). The response is boring and correct: slow down, eye-icon the password field to see what is being typed, check Caps Lock and keyboard layout, and be mindful of the lockout counter quietly climbing in the background. If the failures approach the threshold, stop and reset the password properly through an admin instead of gambling the last attempts.
Message: "Your account has been disabled. Please see your system administrator." Cause: somebody — an admin, an HR off-boarding process, or an automation — unticked the account. Sub-status in the logs: 0xC0000072. Key differences from lockout: a disabled account never re-enables itself, waiting is useless, and the password is irrelevant — even the correct password is refused. The fix is one action for an admin (enable the account in lusrmgr.msc or ADUC; on a local PC, net user Ravi /active:yes does it from an admin command prompt), but the professional step comes first: find out who disabled it and why. Re-enabling an account that security or HR deliberately disabled is not helpfulness — it is an incident.
Expired password: message "Your password has expired and must be changed." (sub-status 0xC0000071). The account is healthy; only the password aged out under policy. Windows normally offers the change right at the sign-in screen — the user sets a new one and walks in. Trouble cases: RDP sessions and some network sign-ins refuse the change flow, so an admin reset (ticking "user must change password at next logon" off or on as appropriate) breaks the loop. Expired account is different: the account itself had an end date (common for contractors and interns — "Account expires" in ADUC / net user output). No password change will save it; an admin must extend or remove the expiry date. Learn the pair and you will never again "fix" an expired contractor account by resetting its password three times.
When the user is remote and cannot describe the screen, the failed-logon event tells the truth. In Event 4625, look at Sub Status:
0xC000006A — account exists, password wrong0xC0000064 — username does not exist (typo, or wrong account entirely)0xC0000234 — account is locked out0xC0000071 — password has expired0xC0000072 — account is disabledFive codes cover nearly every "password is not working" call you will ever take. Bookmark them.
The complete lockout policy walkthrough and all 3 recovery methods, shown live on a real Windows system — this is the video this guide is based on.
▶️ Watch Full VideoThe lock was triggered by earlier failed attempts — possibly from another device still using your old password, like a phone mail app. While locked, even the correct password is refused until an admin unlocks the account or the lockout duration expires.
An expired password means the account is fine but the password must be changed — Windows usually lets the user change it at sign-in. An expired account means the account itself reached its set end date (typical for temporary staff) and only an administrator can extend it.
Event 4625 with Sub Status 0xC0000072 indicates a disabled account. A locked account shows 0xC0000234 in failed attempts and generates Event 4740 at the moment it locks.