Account Locked Out Right Now Fastest Safe Unlock for Local and Domain Accounts

Lockouts are often born from the keyboard, not from an attacker:

1. Check Caps Lock and the keyboard layout indicator on the sign-in screen — an EN/IN layout swap silently changes passwords containing symbols.
2. Click the eye icon in the password box and look at what was actually typed.
3. Stop typing. Do not "try once more" — if the counter has not reset yet, one more failure right after an unlock re-locks the account instantly.
4. Ask where else the account is signed in — phone mail app, a second PC, a mapped drive. If one of those still holds the old password, it will re-lock the account within minutes of your unlock. Fix that device first, or the unlock will not survive.

If the PC has a second administrator account, the fix is immediate:

1. Sign in with the other admin account.
2. Press Windows + R, run lusrmgr.msc, open Users, double-click the locked account and untick Account is locked out, then OK.
3. No lusrmgr (Windows Home)? Open PowerShell as Administrator and run Unlock-LocalUser -Name "Ravi" — then confirm with Get-LocalUser -Name "Ravi" (the output shows the account state).
4. The user signs in with the correct password. If they have genuinely forgotten it, reset it now while you are here — a locked account plus a forgotten password is two problems, not one.

And if there is no second admin and the account is the only one? Do not keep hammering the sign-in screen. Either wait for the lockout duration to expire (if one is set, the account frees itself) or move to the WinPE offline recovery covered in the core guide — that is the designed route for exactly this situation.

On a domain, the lock lives on the domain controllers. Unlock it there:

1. ADUC route: find the user, Properties → Account tab, tick Unlock account (the panel shown above), OK.
2. PowerShell route: Unlock-ADAccount -Identity ravi.kumar — done. To see every currently locked account in the domain first: Search-ADAccount -LockedOut
3. Urgent case, user still failing: unlock against the PDC emulator so the change is authoritative at once: Unlock-ADAccount -Identity ravi.kumar -Server (Get-ADDomain).PDCEmulator. Normal unlocks replicate within minutes, but the PDC is where lockout decisions are centralised.
4. Verify before you tell the user to try: Get-ADUser ravi.kumar -Properties LockedOut should show LockedOut : False.

If the account re-locks within minutes, stop unlocking and start investigating — something, somewhere, is still presenting the old password. That detective work has its own full page (Event 4740 and the caller computer), because unlocking ten times fixes nothing.

A lockout is not a life sentence. Unless the duration was set to 0, Windows unlocks the account automatically when the duration passes — 15, 30, 60 minutes, whatever the policy says. In a real office this is often the smartest first move: tell the user the exact time it frees up, let them work on a spare machine or a colleague's login for tasks that allow it, and spend the wait finding the device that caused the lock. Compare that with the alternative — an admin dropping everything for a rushed unlock, only to watch the account re-lock because the user's phone was still retrying the old mail password. One warning: duration 0 changes everything. With 0, waiting is pointless by design — an administrator must unlock. If your policy uses 0, somebody senior should ask why, because it converts every sticky Caps Lock into a helpdesk ticket.