{"id":817,"date":"2026-10-12T09:00:00","date_gmt":"2026-10-12T09:00:00","guid":{"rendered":"https:\/\/vpslake.com\/blog\/?p=817"},"modified":"2026-10-12T09:00:00","modified_gmt":"2026-10-12T09:00:00","slug":"windows-rdp-account-locked-out-error","status":"publish","type":"post","link":"https:\/\/vpslake.com\/blog\/2026\/10\/12\/windows-rdp-account-locked-out-error\/","title":{"rendered":"Fix Windows RDP Account Locked Out Error (Server 2016-2025)"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The Windows RDP account locked out error means Windows has blocked the account after repeated failed sign-in attempts. This guide shows how to restore access, trace the source, and adjust the lockout policy on Windows Server 2016, 2019, 2022, and 2025 in about 10 minutes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Windows Server 2016, 2019, 2022, or 2025 with Desktop Experience for the graphical steps. Server Core can be managed with PowerShell and a remote console.<\/li>\n\n\n<li>A second local administrator account, administrator access to the domain, or console access through the VPS control panel. If RDP is the only working path, open the VNC console from the VPSLake client area and then launch the VPS control panel (Virtualizor).<\/li>\n\n\n<li>The exact locked username and whether it is local (<code>SERVER_NAME\\USERNAME<\/code>) or domain-based (<code>DOMAIN\\USERNAME<\/code>).<\/li>\n\n\n<li>Five minutes of console access and enough disk space for normal Windows Security event logging; no special RAM or storage allocation is required.<\/li>\n\n\n<li>A <a href=\"https:\/\/vpslake.com\/buy-windows-rdp\">VPSLake Windows RDP server<\/a> if you need a Windows environment for this procedure.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Identify the account and get a recovery session<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use an administrator session that is not the locked account so you do not keep generating failed attempts while trying to repair it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At the Windows console, sign in with another administrator. If you are already connected over RDP as that administrator, open <strong>Windows PowerShell \u2192 Run as administrator<\/strong> and run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>whoami\nhostname<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The result should identify the working administrator and server:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SERVER_NAME\\ADMIN_USERNAME\nSERVER_NAME<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If no account can sign in over RDP, open the VPSLake client area, enter the VPS control panel, and choose the server&#8217;s <strong>VNC Console<\/strong>. A console session bypasses the RDP logon screen and gives you a way to repair the account without changing the RDP service.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Unlock a local Windows account<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Local Users and Groups console clears a local account&#8217;s lockout flag without changing its password or disabling the account.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open <strong>Computer Management \u2192 Local Users and Groups \u2192 Users<\/strong>, double-click <code>YOUR_USERNAME<\/code>, and clear <strong>Account is locked out<\/strong>. Select <strong>Apply \u2192 OK<\/strong>. If that checkbox is not selected, the account may be disabled, expired, or locked by a domain policy instead.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can check the local account&#8217;s basic state from the elevated PowerShell window:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_UserAccount -Filter \"Name='YOUR_USERNAME' AND LocalAccount=True\" | Format-List Name,Domain,Disabled,Lockout<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expected output after the local unlock:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Name     : YOUR_USERNAME\nDomain   : SERVER_NAME\nDisabled : False\nLockout  : False<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the <code>Lockout<\/code> value returns <code>False<\/code> but RDP still rejects the sign-in, continue to Step 3. A saved old password, a disabled account, or an incorrect local\/domain username prefix can produce a similar failure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Unlock a domain account<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Domain lockouts are controlled by Active Directory, so clearing a local server setting will not release a domain user.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On a domain controller or an administrator workstation with RSAT, open <strong>Server Manager \u2192 Tools \u2192 Active Directory Users and Computers<\/strong>. Browse to the user&#8217;s organizational unit, right-click <code>YOUR_USERNAME<\/code>, choose <strong>Properties \u2192 Account<\/strong>, clear <strong>Unlock account<\/strong>, and select <strong>Apply \u2192 OK<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the ActiveDirectory PowerShell module is installed, the same action is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Import-Module ActiveDirectory\nUnlock-ADAccount -Identity \"YOUR_USERNAME\"\nGet-ADUser -Identity \"YOUR_USERNAME\" -Properties LockedOut | Select-Object SamAccountName,LockedOut<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Successful verification resembles:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SamAccountName LockedOut\n-------------- ---------\nYOUR_USERNAME  False<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Use Microsoft&#8217;s <a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/activedirectory\/unlock-adaccount\" target=\"_blank\" rel=\"noopener\"><code>Unlock-ADAccount<\/code> reference<\/a> if the command is unavailable. You need permission to unlock the account, and the domain controller must be reachable.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Find what caused the lockout<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Unlocking the account is temporary if a phone, service, scheduled task, mapped drive, or saved RDP credential is still sending an old password.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open <strong>Event Viewer \u2192 Windows Logs \u2192 Security<\/strong>, choose <strong>Filter Current Log<\/strong>, and filter for event IDs <code>4740<\/code> and <code>4625<\/code>. Event 4740 records the locked account and, where available, the caller computer name; event 4625 shows failed logons. You can query recent events from an elevated PowerShell prompt:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4740} -MaxEvents 10 | Select-Object TimeCreated,Id,Message\nGet-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 10 | Select-Object TimeCreated,Id,Message<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For a domain account, run the 4740 query on the domain controller handling the lockout. Look for <code>Caller Computer Name<\/code>, then inspect that computer for <strong>Control Panel \u2192 Credential Manager \u2192 Windows Credentials<\/strong>, saved RDP entries, mapped drives, services, and scheduled tasks using the affected username. Microsoft&#8217;s <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/security\/threat-protection\/auditing\/event-4740\" target=\"_blank\" rel=\"noopener\">Event 4740 documentation<\/a> explains the fields.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the caller is unknown or the events show repeated attempts from an unexpected host, change the password after unlocking the account, remove stale credentials, and restrict RDP to trusted source addresses or a VPN. Do not repeatedly unlock an account while an active password-guessing attempt continues.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Adjust the account lockout policy<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Change the policy only after fixing the source; a higher threshold can hide a broken service or make password attacks harder to notice.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For a standalone server, open <strong>Local Security Policy \u2192 Account Policies \u2192 Account Lockout Policy<\/strong>. For a domain, edit the effective domain GPO through <strong>Group Policy Management \u2192 Computer Configuration \u2192 Policies \u2192 Windows Settings \u2192 Security Settings \u2192 Account Policies \u2192 Account Lockout Policy<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Set these values according to your security policy:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Account lockout threshold:<\/strong> Use a nonzero value such as <code>10<\/code> to preserve brute-force protection. Set it to <code>0<\/code> only when you intentionally want to disable lockouts and have compensating controls such as IP-restricted RDP, a VPN, and strong unique passwords.<\/li>\n\n\n<li><strong>Account lockout duration:<\/strong> <code>15<\/code> minutes is a practical starting point for temporary lockouts.<\/li>\n\n\n<li><strong>Reset account lockout counter after:<\/strong> <code>15<\/code> minutes, or another value no greater than the lockout duration.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Select <strong>Apply \u2192 OK<\/strong>, then refresh policy from an elevated prompt if this is a domain-managed server:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>gpupdate \/force<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expected output includes successful computer policy processing:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Computer Policy update has completed successfully.<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">These settings are documented in Microsoft&#8217;s <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/security\/threat-protection\/security-policy-settings\/account-lockout-policy\" target=\"_blank\" rel=\"noopener\">Account Lockout Policy guidance<\/a>. Domain policy or fine-grained password policy can override a local setting, so verify the effective policy on the domain controller.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Verify the RDP sign-in<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Verification must use a fresh authentication attempt and the correct account scope, not just an unlock confirmation.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Keep the console or administrator session open.<\/li>\n\n\n<li>Remove the old saved credential on the connecting computer under <strong>Control Panel \u2192 Credential Manager \u2192 Windows Credentials<\/strong>.<\/li>\n\n\n<li>Start a new RDP connection to <code>SERVER_IP<\/code> and enter <code>SERVER_NAME\\YOUR_USERNAME<\/code> for a local user or <code>DOMAIN\\YOUR_USERNAME<\/code> for a domain user.<\/li>\n\n\n<li>After signing in, confirm that the RDP listener is reachable from the client:<\/li>\n\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>Test-NetConnection -ComputerName SERVER_IP -Port 3389<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The important result is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>TcpTestSucceeded : True<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the connection succeeds and no new 4625 or 4740 event appears, the lockout is fixed. Keep the recovery console available until you have confirmed that services and scheduled tasks also use the current credential.<\/p>\n\n\n\n<aside class=\"vl-element vl-cta-banner\" aria-label=\"Need a Windows RDP server?\">\n\t<div class=\"vl-cta-banner__content\">\n\t\t<p class=\"vl-cta-banner__eyebrow\">Secure Windows access<\/p>\n\t\t<h3 class=\"vl-cta-banner__title\">Need a Windows RDP server?<\/h3>\n\t\t<p class=\"vl-cta-banner__text\">Get a Windows RDP environment for remote administration and reliable desktop access.<\/p>\n\t<\/div>\n\t<a class=\"vl-cta-banner__button\" href=\"\/buy-windows-rdp\" aria-label=\"View Windows RDP\">View Windows RDP<\/a>\n<\/aside>\n\n\n\n<h2 class=\"wp-block-heading\">Troubleshooting<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\u201cThe referenced account is currently locked out\u201d after unlocking<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Another device or process is still submitting the old password, or a domain controller has not replicated the unlock yet. Check event 4740 again, stop the offending service or scheduled task, update its stored credential, and retry after the domain controllers show the same account state.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The Account is locked out checkbox is missing<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You may be viewing a domain account, using an account without administrator rights, or running an edition without the Local Users and Groups console. Use Active Directory Users and Computers for a domain user, or open the VPS control panel&#8217;s VNC console with another local administrator.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><code>Unlock-ADAccount<\/code> is not recognized<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The ActiveDirectory module or RSAT tools are not installed, or the command is being run on a standalone server. Use <strong>Server Manager \u2192 Tools \u2192 Active Directory Users and Computers<\/strong> on an RSAT-enabled administrator workstation, or repair the local account through <strong>Computer Management \u2192 Local Users and Groups<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The account locks again immediately<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Treat this as a source problem, not a policy problem. Inspect event 4740, saved credentials, Windows services, scheduled tasks, mapped drives, email clients, and RDP clients; if the caller is unfamiliar, change the password and restrict the RDP firewall rule to trusted IP addresses.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Hardening<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Keep the lockout threshold nonzero unless you have a documented reason to disable it; threshold <code>0<\/code> removes a useful brute-force signal.<\/li>\n\n\n<li>Use a separate named administrator for routine work and a long, unique password for every Windows server.<\/li>\n\n\n<li>Restrict inbound RDP in Windows Defender Firewall to trusted source IP addresses or a VPN, and avoid exposing it to the entire internet when possible.<\/li>\n\n\n<li>Review Security log retention and alert on repeated 4625 and 4740 events so a future lockout has an identifiable source.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Does restarting Windows unlock an RDP account?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. Restarting does not reliably clear a local or domain account lockout, and it will not stop another device from sending an outdated password. Unlock the account through the appropriate local or domain administrator tool and fix the process causing the failures.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How long does a Windows RDP account stay locked?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It depends on <strong>Account lockout duration<\/strong>. A nonzero duration unlocks the account automatically after that period; a duration of <code>0<\/code> keeps it locked until an administrator clears it. Domain policy can differ from the local server policy.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Can I disable account lockout completely?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes, setting <strong>Account lockout threshold<\/strong> to <code>0<\/code> disables lockouts for that policy scope. It also removes protection against repeated password guessing and lets an attacker create fewer lockout alerts, so use IP restrictions, a VPN, strong passwords, and monitoring before choosing this setting.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why does the account lock again after I change the password?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A service, scheduled task, mapped drive, mobile device, or saved RDP credential may still contain the old password. Find the caller in event 4740 or nearby 4625 events, update or remove that credential, and then unlock the account again.<\/p>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Does restarting Windows unlock an RDP account?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. Restarting does not reliably clear a local or domain account lockout, and it will not stop another device from sending an outdated password. Unlock the account through the appropriate local or domain administrator tool and fix the process causing the failures.\"}}, {\"@type\": \"Question\", \"name\": \"How long does a Windows RDP account stay locked?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"It depends on **Account lockout duration**. A nonzero duration unlocks the account automatically after that period; a duration of `0` keeps it locked until an administrator clears it. Domain policy can differ from the local server policy.\"}}, {\"@type\": \"Question\", \"name\": \"Can I disable account lockout completely?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes, setting **Account lockout threshold** to `0` disables lockouts for that policy scope. It also removes protection against repeated password guessing and lets an attacker create fewer lockout alerts, so use IP restrictions, a VPN, strong passwords, and monitoring before choosing this setting.\"}}, {\"@type\": \"Question\", \"name\": \"Why does the account lock again after I change the password?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"A service, scheduled task, mapped drive, mobile device, or saved RDP credential may still contain the old password. Find the caller in event 4740 or nearby 4625 events, update or remove that credential, and then unlock the account again.\"}}]}<\/script>\n\n","protected":false},"excerpt":{"rendered":"Fix the Windows RDP account locked out error, unlock the right account, find stale credentials, and tune lockout policy without losing server access.","protected":false},"author":1,"featured_media":818,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","footnotes":""},"categories":[5,11],"tags":[50,32,23,51,42],"class_list":["post-817","post","type-post","status-publish","format-standard","has-post-thumbnail","category-guides","category-windows-server","tag-account-lockout","tag-rdp","tag-remote-desktop","tag-security","tag-windows-server","cs-entry"],"_links":{"self":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/817","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/comments?post=817"}],"version-history":[{"count":1,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/817\/revisions"}],"predecessor-version":[{"id":3044,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/817\/revisions\/3044"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media\/818"}],"wp:attachment":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media?parent=817"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/categories?post=817"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/tags?post=817"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}