Windows Account Lockout Policy and 3 Recovery Methods Complete Guide
Five wrong passwords and the account slams shut — that is the account lockout policy doing its job. The trouble starts when the locked account is the only admin on the PC. This guide explains the policy properly and then walks through the 3 recovery methods every IT admin should know.
🎥 Watch the full video — Windows account lockout policy and all 3 recovery methods, demonstrated step by step
The account lockout policy is one of the most common security policies in Windows. It is also one of the most misunderstood. When it is set up well, it quietly stops password-guessing attacks. When it is set up badly — or when nobody planned for the day the administrator gets locked too — a two-minute password mistake turns into a full work stoppage. Below you will find what the three policy values really do, where to set them, and the 3 recovery methods from the video: unlocking through another admin account, WinPE offline recovery, and the last-resort routes for domain controllers. Every method here is for machines you own or are authorised to administer.
Windows sign-in screen — the message every locked user sees
Sign-in
The referenced account is currently locked out and may not be logged on to.
👆 This exact wording means lockout — not a wrong password and not a disabled account (sign-in screen recreated with the real Windows message)
1
What the Account Lockout Policy Actually Does
The policy has exactly three working parts. All three live under Account Policies → Account Lockout Policy — in secpol.msc on a single PC, or in the Default Domain Policy for a whole domain:
Account lockout threshold — how many wrong passwords are allowed before the account locks. Set it to 5 and the 5th wrong attempt locks the account. Set it to 0 and lockout is off completely — that is the Windows default on a fresh install.
Account lockout duration — how many minutes the account stays locked. After this time it unlocks by itself. Set 0 here and the lock never expires — only an administrator can unlock it.
Reset account lockout counter after — how long Windows remembers failed attempts. If the threshold is 5 and this window is 30 minutes, the attacker (or the forgetful user) must make all 5 mistakes inside 30 minutes to trigger the lock. This value can never be longer than the duration.
One important detail: on a domain, every domain controller counts bad passwords for an account separately, and the lockout is recorded on the domain controller that processed the failures. That is why one DC can show an account as locked while another still shows only a few bad attempts — and why the PDC emulator is always the first place to check.
2
Method 1 — Unlock Through Another Administrator Account
The fastest and cleanest recovery is the one the video starts with: sign in with any other admin account and simply clear the lock. This also works remotely — an IT support engineer can do it over a support session without visiting the desk.
Standalone PC: sign in with a second admin account, open lusrmgr.msc, double-click the locked user and untick Account is locked out. On Windows Home (no lusrmgr), use an admin PowerShell window: Unlock-LocalUser -Name "Ravi"
Domain PC: open Active Directory Users and Computers, find the user, open Properties → Account tab and tick Unlock account. Or one line of PowerShell: Unlock-ADAccount -Identity ravi.kumar
No second admin handy, but duration is set? Waiting is a legitimate fix. If the duration is 30 minutes, the account frees itself in 30 minutes — nobody has to touch anything.
The catch the video warns about: this method dies when the only admin account is the locked one — and a user at a sign-in screen can absolutely lock the admin too, just by typing the wrong password against the admin account enough times. That is exactly when you move to Method 2.
3
Before Method 2 — The BIOS and Boot Checks That Make or Break It
Offline recovery means booting the PC from something other than its own Windows — so the BIOS/UEFI setup becomes part of the job:
Open the one-time boot menu (commonly F12, F9 or Esc depending on the brand) and select your WinPE USB stick. If the stick never appears, the boot mode is the usual suspect — a stick made for UEFI will not show in Legacy/CSM mode and the other way round.
If the recovery media refuses to boot because of Secure Boot, note the setting, change only what you need, and put it back afterwards. On office machines, check your change policy before touching it.
While you are in setup, glance at the system clock. A dead CMOS battery and a wildly wrong clock will break domain logons later with Kerberos time errors — a classic BIOS-level cause of mystery sign-in failures.
4
Method 2 — WinPE Offline Recovery When No Admin Can Log In
When every admin account is locked and waiting is not an option, boot the PC into a WinPE recovery environment from USB and repair the account offline, exactly as demonstrated in the video. Because Windows itself is not running, its lockout cannot stop you.
Boot from the WinPE USB (boot menu, as covered above) on the machine you own or administer.
Microsoft's own tool for this job is the Locksmith wizard in the DaRT recovery toolkit — it exists precisely to unlock and reset local accounts on a PC that will not let anyone in. Offline SAM-editing tools do the same job by clearing the account's lockout flag directly in the local account database.
Clear the lock (or set a fresh password on the local admin), remove the USB, and boot Windows normally. Sign in and immediately set a proper password and re-check the policy.
Two honest limits. First, if the disk is protected by BitLocker, you will need the recovery key before any offline tool can even read the drive — without it, this method simply does not work, by design. Second, this only repairs local accounts. A domain account's lock lives on the domain controllers, not on this PC, so offline tools cannot touch it — domain locks are cleared in Method 1 or Method 3.
5
Method 3 — When the Lock Is on a Domain Controller
The worst version of this problem happens on a server: admin accounts locked across the domain, and nobody can sign in to fix it. The routes that remain are slower but real:
Any other Domain Admin — sounds obvious, yet offices forget the second admin account until the day they need it. One working Domain Admin can unlock everyone else from ADUC or PowerShell.
Wait for the duration — domain lockouts also expire on their own when a duration is set. An inconvenient hour is still better than a risky hack on a production controller.
Directory Services Restore Mode (DSRM) — restart the DC and choose DSRM from the boot options (F8 / Startup Settings). You sign in with the DSRM administrator password that was set when the DC was promoted. DSRM gives you local control of the server while Active Directory is offline, so you can repair the situation and restart normally. If nobody in the organisation knows the DSRM password, that is a finding worth fixing today — before you ever need it.
Notice what is not on this list: there is no supported way to "reset" a domain account's lock from the workstation side. Anyone selling you one is selling you a problem.
6
Set the Policy So This Never Becomes an Emergency Again ⭐
Recovery is step one. Step two is tuning the policy so honest mistakes stay small and real attacks stay blocked:
Pick a sane threshold — 5 to 10 wrong attempts. A threshold of 2 or 3 mostly locks out legitimate users with a sticky Caps Lock key.
Give it a real duration — 15 to 30 minutes. Avoid duration 0 unless a full-time admin team genuinely unlocks accounts all day.
Set the reset counter equal to the duration — simple, predictable, and what most baselines do.
Keep two admin accounts on every important machine, and write the DSRM password down in the company password vault.
Turn on lockout auditing (events 4740 and 4625) so the next lockout arrives with its own explanation attached.
Each of these follow-ups has its own detailed page on this site — find what keeps re-locking an account, choose policy numbers, or set up the auditing — so the next "Sir, laptop locked ho gaya" call takes two minutes, not two hours.
🔴 Only on machines you own or administer: every recovery method in this guide is for IT admins and owners recovering their own systems. Never use offline recovery tools on a computer you do not own or have written permission to service.
🎥 See the Lockout Recovery Methods in the Video
The complete lockout policy walkthrough and all 3 recovery methods, shown live on a real Windows system — this is the video this guide is based on.
Yes — if the lockout duration is set to anything above 0, the account unlocks automatically when that time passes. Duration 0 is the exception: the account then stays locked until an administrator unlocks it manually.
My account is locked and I am the only admin. What actually works?
Waiting works if a duration is set. If not, the real routes are offline recovery: boot the PC from a WinPE USB and clear the lock on the local account (Microsoft's DaRT Locksmith is the official tool for this), or, for domain admin problems, Directory Services Restore Mode on a domain controller. Both are covered step by step in the core guide above and in the video.
Is the built-in Administrator account protected from lockout?
Not automatically. There is a specific security option — Allow Administrator account lockout — that decides whether the built-in Administrator can be locked at all, and since the October 2022 Windows updates, new systems can lock the built-in Administrator after repeated bad passwords by default. This is exactly the trap in the video: the locked account can be the admin itself.
This guide is based on the Technical Anshu Windows Account Lockout Policy video • Stuck on a step? Ask in the video comments — you will get a reply 🙏