It sounds impossible until it happens to you: the user locked the laptop, you go to unlock it — and your admin account is locked too. This is the worst-case playbook, and every route in it is a legitimate one.
This is the exact disaster the video builds up to. A user mistypes passwords at a sign-in screen — including against the administrator account — and suddenly the one account that could fix everything is the account that is locked. Before panic sets in, understand one calming fact: a lockout is a state, not a destruction. The account, its password and its data are all intact. And there are real, supported ways back in — they are just slower than the day you wish you had made a second admin account. Work them in this order, from least invasive to most.
If the lockout duration is set to anything above 0, the admin account unlocks itself when the timer ends — no tools, no risk, no heroics. In a surprising number of "total disasters", the correct fix is a coffee and 30 minutes. While waiting, verify the situation calmly: is it only the admin who is locked, or every account? Is this one PC or domain-wide? Answers change the route. The exception is duration 0 — the account then waits for an admin unlock by design, and waiting is pointless. If your organisation set duration 0 and kept a single admin account, you are now paying for two decisions at once. Proceed to the next routes.
Search properly before reaching for recovery tools:
lusrmgr.msc.Unlock-ADAccount in seconds. The lock lives on the domain controllers, so the rescuer does not need to touch the affected machine at all.When every Domain Admin is locked, the controller itself still has a door: Directory Services Restore Mode. Restart the DC, interrupt the boot (F8 or through Startup Settings), and choose Directory Services Restore Mode. You sign in not with a domain account but with the DSRM administrator password — a local credential created on the day the server was promoted to a domain controller. In DSRM, Active Directory is offline and you hold local control of the server: enough to inspect, repair and restart the machine normally so domain services come back. Honest limitations, stated plainly: DSRM is a server-repair mode, not a magic unlock button — its power is that it gives a trusted person operating-system control of the DC when the directory itself is the problem. And if nobody knows the DSRM password, that gap — not the lockout — is your real incident. Set a new one with ntdsutil on a working DC today, store it in the company vault, and test this route before you ever need it at 2 AM.
For a standalone PC (or a machine's local admin), the offline route from the video applies: boot from a WinPE USB, use a recovery tool such as Microsoft's DaRT Locksmith to clear the local account's lock, and boot back into Windows. Know its boundaries cold: it works on local accounts only — waving a WinPE stick at a PC does nothing for a domain account's lock, which lives on the DCs. And if the drive is BitLocker-encrypted, you need the recovery key before the disk can even be read — without it there is no route, which is exactly what BitLocker is for. A final option administrators whisper about: if the disk is accessible and the machine was going to be rebuilt anyway, recovering the user's data offline and reimaging the PC is sometimes faster and cleaner than fighting for the old installation. Choose it deliberately, not in frustration.
Every step above is a tax on one missing habit: redundant admin access, prepared in advance.
Five minutes of setup in a calm week replaces all of the heroics in this article.
The complete lockout policy walkthrough and all 3 recovery methods, shown live on a real Windows system — this is the video this guide is based on.
▶️ Watch Full VideoYes, depending on policy. The security option Allow Administrator account lockout controls it, and since the October 2022 Windows updates the built-in Administrator can be locked by default on new systems — introduced specifically because attackers were brute-forcing that account over the network, where it historically had no lockout protection.
The Directory Services Restore Mode password is set when a server is promoted to a domain controller. It is not stored anywhere readable afterwards — it should be recorded in the organisation's password vault at promotion time. If it is lost, reset it on a working DC with ntdsutil (set DSRM password) before an emergency, not during one.
No supported one. A domain account's lockout state lives on the domain controllers, so the unlock must happen there — through another admin, automatically when the duration expires, or by repairing the DC itself through DSRM. Offline PC tools only affect local accounts.