> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fix "The User Account Has Been Locked" on Windows Server RDP

> Windows Server account locked out over RDP? Sign in on the console, unlock it in Computer Management, then find the source in event 4740 and stop it.

If Remote Desktop says the user account has been locked, Windows' account lockout policy has blocked the account after too many wrong passwords, usually from bots guessing passwords on port 3389. Lockout only blocks network sign-ins such as RDP, so sign in through the console, open **Computer Management > Local Users and Groups > Users**, open the account and clear **Account is locked out**. Then find the source in Security event `4740` and protect RDP.

You may see either message:

```text theme={null}
As a security precaution, the user account has been locked because there were too many logon attempts or password change attempts. Wait a while before trying again, or contact your system administrator or technical support.
```

```text theme={null}
The referenced account is currently locked out and may not be logged on to.
```

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 10 to 20 minutes | Windows Server 2019 / 2022 / 2025 (local accounts) | Console access, another administrator password or the same account on the console |

## Before you start

* Microsoft states that lockout "applies only to network logons such as RDP. Console logons are still allowed during a lockout." On a VPS, open the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) and sign in there. On a dedicated server without console access, [open a ticket](https://freakhosting.com/clientarea/submitticket.php).
* If you also forgot the password, see [change the Administrator password](https://help.freakhosting.com/portals/other/how-to-change-the-administrator-password-on-windows-server.md) or [reset your VPS root password](https://help.freakhosting.com/portals/vps-panel/how-to-reset-your-vps-root-password.md).

## Option 1: wait for the lockout to expire

If the lockout policy sets an **Account lockout duration**, the account unlocks itself after that time. Microsoft's recommended baseline is 10 failed attempts within 10 minutes, then a 10-minute lockout. While bots keep guessing, though, the account can lock again straight away, so the console fix below is usually quicker.

## How to unlock the account

**1. Sign in on the console**

Open the VNC console and sign in with the locked account or another administrator account.

**2. Open Computer Management**

Press **Windows+R**, type `compmgmt.msc` and press **Enter**. Go to **System Tools > Local Users and Groups > Users**.

**3. Unlock the account**

Double-click the locked account, clear **Account is locked out** and click **OK**.

**4. Connect with RDP again**

Connect with Remote Desktop straight away, before the next wave of failed attempts locks it again.

> [!NOTE]
>
> On a server joined to an Active Directory domain, domain accounts are locked on the domain controller. Unlock them in **Active Directory Users and Computers** on the domain controller instead.

## Cause 1: password-guessing bots on the RDP port (most likely)

**Check:** in Event Viewer, open **Windows Logs > Security** and filter for event ID `4625` ("An account failed to log on"). Many events with **Logon Type** `10` (Remote Desktop) or `3` (network) from unknown **Source Network Address** values mean an automated attack. Or in PowerShell:

```powershell theme={null}
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-1) } |
  Measure-Object
```

**Fix:** reduce who can reach RDP.

* Allow RDP only from your own IP addresses in Windows Firewall; see [open a port in Windows Firewall](https://help.freakhosting.com/portals/other/how-to-open-a-port-in-windows-firewall.md).
* [Change the RDP port](https://help.freakhosting.com/portals/other/how-to-change-the-rdp-port-on-windows-server.md) to cut the noise from scanners.
* Use a long, unique password and keep Network Level Authentication on.

Full steps are in [protect RDP from brute-force attacks](https://help.freakhosting.com/portals/other/how-to-protect-rdp-from-brute-force-attacks.md).

## Cause 2: an old password saved somewhere

**Check:** event `4740` ("A user account was locked out") in the Security log. Its **Caller Computer Name** shows where the failed attempts came from. A familiar name or IP points to your own device or a service.

**Fix:** update or delete the saved password in that place: a saved `.rdp` connection, a mapped drive, a scheduled task, or a Windows service that runs as this account.

## How the lockout policy is set

Open `secpol.msc` (Local Security Policy) and go to **Security Settings > Account Policies > Account Lockout Policy**. You see:

| Setting | What it does |
| - | - |
| **Account lockout threshold** | Failed attempts before the account locks. `0` means never lock. |
| **Account lockout duration** | Minutes until a locked account unlocks itself. |
| **Reset account lockout counter after** | Minutes after which the failed-attempt count starts again. |
| **Allow Administrator account lockout** | Whether the built-in Administrator account can be locked too. |

> [!WARNING]
>
> Don't set the threshold to `0` to stop lockouts. Microsoft notes this "doesn't prevent a brute force attack". Restrict access to RDP instead, so the attempts never reach the server.

## How to check it worked

You can sign in with Remote Desktop again, and the Security log shows few or no new `4625` events after you restricted RDP.

## Frequently asked questions

### Can the built-in Administrator account be locked out?

Yes, if **Allow Administrator account lockout** is enabled. Microsoft added this option with the October 2022 cumulative updates. On new installations that already include those updates, Windows turns lockout on during setup. Console sign-in still works.

### Why does the account lock again a few minutes later?

The attack is still running. Unlocking doesn't stop it; restrict RDP to your IP or move the port.

### Should I rename the Administrator account?

It helps against bots that guess the `Administrator` user name. Create a second administrator account first and test it. See the [Windows Server security checklist](https://help.freakhosting.com/portals/other/windows-server-security-checklist.md).

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Protect RDP from brute force](https://help.freakhosting.com/portals/other/how-to-protect-rdp-from-brute-force-attacks.md)
>
> Stop password-guessing bots.

> [card] [Failed login attempts](https://help.freakhosting.com/portals/other/how-to-see-failed-login-attempts-on-windows-server.md)
>
> Read event 4625 in detail.

> [card] [Change the RDP port](https://help.freakhosting.com/portals/other/how-to-change-the-rdp-port-on-windows-server.md)
>
> Move RDP off 3389.

> [card] [Change the Administrator password](https://help.freakhosting.com/portals/other/how-to-change-the-administrator-password-on-windows-server.md)
>
> Set a strong password.

> [card] [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md)
>
> Sign in when RDP is locked.

***

> [!NOTE]
>
> **Checked against [Microsoft Support: KB5020282 account lockout for built-in administrators](https://support.microsoft.com/en-us/topic/kb5020282-account-lockout-available-for-built-in-local-administrators-bce45c4d-f28d-43ad-b6fe-70156cb2dc00), [Microsoft Learn: Account lockout threshold](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-threshold), [Event 4740](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4740) and [Event 4625](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625)** on 4 November 2026. Steps were not tested on a live Windows server for this page.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.