Skip to main content
If Remote Desktop says the user account has been locked, Windows’ account lockout policy has blocked the account after too many wrong passwords, usually from bots guessing passwords on port 3389. Lockout only blocks network sign-ins such as RDP, so sign in through the console, open Computer Management > Local Users and Groups > Users, open the account and clear Account is locked out. Then find the source in Security event 4740 and protect RDP. You may see either message:

​
Before you start

​
Option 1: wait for the lockout to expire

If the lockout policy sets an Account lockout duration, the account unlocks itself after that time. Microsoft’s recommended baseline is 10 failed attempts within 10 minutes, then a 10-minute lockout. While bots keep guessing, though, the account can lock again straight away, so the console fix below is usually quicker.

​
How to unlock the account

1

Sign in on the console

Open the VNC console and sign in with the locked account or another administrator account.
2

Open Computer Management

Press Windows+R, type compmgmt.msc and press Enter. Go to System Tools > Local Users and Groups > Users.
3

Unlock the account

Double-click the locked account, clear Account is locked out and click OK.
4

Connect with RDP again

Connect with Remote Desktop straight away, before the next wave of failed attempts locks it again.
On a server joined to an Active Directory domain, domain accounts are locked on the domain controller. Unlock them in Active Directory Users and Computers on the domain controller instead.

​
Cause 1: password-guessing bots on the RDP port (most likely)

Check: in Event Viewer, open Windows Logs > Security and filter for event ID 4625 (“An account failed to log on”). Many events with Logon Type 10 (Remote Desktop) or 3 (network) from unknown Source Network Address values mean an automated attack. Or in PowerShell:
Fix: reduce who can reach RDP. Full steps are in protect RDP from brute-force attacks.

​
Cause 2: an old password saved somewhere

Check: event 4740 (“A user account was locked out”) in the Security log. Its Caller Computer Name shows where the failed attempts came from. A familiar name or IP points to your own device or a service. Fix: update or delete the saved password in that place: a saved .rdp connection, a mapped drive, a scheduled task, or a Windows service that runs as this account.

​
How the lockout policy is set

Open secpol.msc (Local Security Policy) and go to Security Settings > Account Policies > Account Lockout Policy. You see:
Don’t set the threshold to 0 to stop lockouts. Microsoft notes this “doesn’t prevent a brute force attack”. Restrict access to RDP instead, so the attempts never reach the server.

​
How to check it worked

You can sign in with Remote Desktop again, and the Security log shows few or no new 4625 events after you restricted RDP.

​
Frequently asked questions

​
Can the built-in Administrator account be locked out?

Yes, if Allow Administrator account lockout is enabled. Microsoft added this option with the October 2022 cumulative updates. On new installations that already include those updates, Windows turns lockout on during setup. Console sign-in still works.

​
Why does the account lock again a few minutes later?

The attack is still running. Unlocking doesn’t stop it; restrict RDP to your IP or move the port.

​
Should I rename the Administrator account?

It helps against bots that guess the Administrator user name. Create a second administrator account first and test it. See the Windows Server security checklist.

VPS and dedicated server guides

Every guide in this section.

Protect RDP from brute force

Stop password-guessing bots.

Failed login attempts

Read event 4625 in detail.

Change the RDP port

Move RDP off 3389.

Change the Administrator password

Set a strong password.

VNC console

Sign in when RDP is locked.
Checked against Microsoft Support: KB5020282 account lockout for built-in administrators, Microsoft Learn: Account lockout threshold, Event 4740 and Event 4625 on 4 November 2026. Steps were not tested on a live Windows server for this page.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026