Technical Anshu
Tutorials Blog
🔐 Remote Unlock

Unlock a Domain Account Remotely with PowerShell Unlock ADAccount and RSAT

The locked user is 200 kilometres away in a branch office. You do not need to travel, and you do not need their PC. A domain account unlocks where it lives — on the domain controller — and PowerShell does it in one line from your desk.

✍️ Technical Anshu🪟 Windows Server / Windows 10 / 11⏱️ 8 minute read
🎥 Watch the full video — Windows account lockout policy and all 3 recovery methods, demonstrated step by step

Remote unlock works because of where lockout state lives: not on the user's PC, but in Active Directory itself. Any admin machine with the right tools can clear it. This page covers the full route: installing RSAT (the admin tools) on your Windows PC, finding every locked account with Search-ADAccount, unlocking with Unlock-ADAccount, aiming the change at the PDC emulator when seconds matter, and verifying the unlock actually took effect before you tell the user to try again. All commands below are copy-paste ready and must run in PowerShell with an account that has domain admin (or delegated unlock) rights.

Windows PowerShell — finding every locked account in the domain
PS C:\> Search-ADAccount -LockedOut DistinguishedName : CN=Ravi Kumar,OU=Branch,DC=office,DC=local Enabled : True LockedOut : True Name : Ravi Kumar SamAccountName : ravi.kumar
👆 One command lists every locked account in the domain (output recreated with the real fields; names are examples)
1

Get the Tools — RSAT on Your Admin PC

You do not need to remote into a server for this. Windows 10 and 11 carry the admin tools as optional features:

  1. Settings → Apps → Optional features → Add a feature, and install RSAT: Active Directory Domain Services and Lightweight Directory Services Tools. Or do it in one PowerShell line (run as Administrator): Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability -Online installs the full set.
  2. Open PowerShell and load the module — it imports automatically on first use: Import-Module ActiveDirectory
  3. Quick connectivity test: Get-ADDomain should return your domain's details, including the PDC emulator name you will want in a moment.

No RSAT possible on your machine? The fallback is unchanged since forever: RDP into a domain controller and run the identical commands there.

2

Find and Unlock — the Two Commands That Matter

  1. See who is locked, domain-wide: Search-ADAccount -LockedOut
  2. Unlock one account: Unlock-ADAccount -Identity ravi.kumar
  3. Unlock everyone the command found (careful — read the list first): Search-ADAccount -LockedOut | Unlock-ADAccount
  4. Prove it before phoning the user: Get-ADUser ravi.kumar -Properties LockedOut, BadLogonCount — you want LockedOut : False.

Notice what you did not do: reset the password. A lockout is not a forgotten password. Resetting "just in case" creates a second problem — every device and service holding the old password now starts failing and re-locking the account. Unlock only; reset only when the user genuinely does not know the password.

3

When Seconds Matter — Aim at the PDC Emulator

Normal unlocks replicate between domain controllers within minutes, which occasionally shows up as "I unlocked it but the branch still says locked" — the branch's local DC has not received the change yet. Lockout processing is anchored on the PDC emulator, so aim there directly:

  1. Find it: (Get-ADDomain).PDCEmulator
  2. Unlock against it: Unlock-ADAccount -Identity ravi.kumar -Server (Get-ADDomain).PDCEmulator
  3. Verify against the same server: Get-ADUser ravi.kumar -Server (Get-ADDomain).PDCEmulator -Properties LockedOut

If the account re-locks after a clean unlock, the command work is done and the detective work starts: something still holds the old password. Get the caller computer from Event 4740 and follow the repeat-lockout guide on this site instead of unlocking a fourth time.

4

Bonus — Unlocking a Local Account on a Remote PC

Different target, same idea — for a standalone PC's local account, PowerShell remoting carries the local equivalent:

  1. Connect: Enter-PSSession -ComputerName BRANCH-PC07 (WinRM must be enabled on the target — in most domains it is, via policy).
  2. Unlock locally: Unlock-LocalUser -Name "Ravi"
  3. Leave: Exit-PSSession

And one helpdesk habit worth the whole page: verify the caller before unlocking. An "unlock my account" phone call is a classic social-engineering opener. Call back on the number in your directory, or confirm through the branch manager. Thirty seconds of verification is the difference between support and handing an attacker a fresh set of attempts.

🔴 Only on machines you own or administer: every recovery method in this guide is for IT admins and owners recovering their own systems. Never use offline recovery tools on a computer you do not own or have written permission to service.

🎥 See the Lockout Recovery Methods in the Video

The complete lockout policy walkthrough and all 3 recovery methods, shown live on a real Windows system — this is the video this guide is based on.

▶️ Watch Full Video
❓ Frequently Asked Questions

What is the PowerShell command to unlock an AD account?

Unlock-ADAccount -Identity username, run in PowerShell with the ActiveDirectory module (part of RSAT) and suitable admin rights. Pair it with Search-ADAccount -LockedOut to find locked accounts, and Get-ADUser with the LockedOut property to verify.

I unlocked the account but the user still cannot log in at the branch. Why?

Usually replication timing: the branch domain controller has not received the unlock yet. Unlock directly against the PDC emulator using the -Server parameter, verify there, and give it a few minutes. If it re-locks instead, a device with the old password is the real problem.

Can I unlock accounts without being a Domain Admin?

Yes, if the rights are delegated. Unlocking accounts is one of the most commonly delegated helpdesk tasks in Active Directory — an admin can grant a support group unlock permission on specific OUs without giving them full Domain Admin, which is the safer setup for larger teams.

This guide is based on the Technical Anshu Windows Account Lockout Policy video • Stuck on a step? Ask in the video comments — you will get a reply 🙏