IT Support Knowledge Base

← All runbooksAccounts

Password Reset and Account Lockout

A user forgot their password, their password expired, or their account is locked after failed sign-ins.

Active Directory / Microsoft 365 (Entra ID) accounts, plus local Linux accountsabout 3 min read

Symptoms

  • "Your account has been locked out" or "Your password has expired".
  • "The user name or password is incorrect" and the user is sure it's right.
  • The account keeps locking again within minutes of being unlocked.
  • User has forgotten the password and the self-service reset isn't available.

Before you start: verify who is asking

Never reset a password for someone you haven't verified. Attackers phone help desks pretending to be staff. Follow your organisation's identity-check procedure. Typical examples are calling back on the number on file, confirming details only the user would know, or manager approval. If you don't have a procedure, ask your lead before resetting anything.

Also decide which of the three problems this is, because the fix differs:

Problem Typical sign Fix
Forgotten password User can't remember it Self-service reset, or admin reset
Expired password Message says expired User sets a new one (or admin reset)
Locked out Message says locked, or "too many attempts" Unlock (wait for the timer or admin unlock), then find out why

Steps

  1. Verify identity as described above and note how you verified (not the answers themselves).
  2. Try self-service first if your organisation has it (for Microsoft 365, the user can use the "Forgot my password" link on the sign-in page if self-service password reset is enabled).
  3. Active Directory (on-premises): open Active Directory Users and Computers, find the user, then:
    • Unlock: right-click the user > Properties > Account tab > tick Unlock account > OK.
    • Reset: right-click the user > Reset Password. Tick User must change password at next logon.
  4. Microsoft 365 admin center (cloud accounts): Users > Active users > select the user > Reset password. Check the user isn't marked Blocked from signing in in the same panel.
  5. Share the temporary password securely (phone call to a verified number, or your organisation's approved method). Never put a password in a ticket, chat or email.
  6. Find out why it locked if it happens again. The usual culprits are old saved passwords on other devices:
    • Phone or tablet email still using the old password.
    • A second computer, a mapped network drive, a saved Remote Desktop connection or a scheduled task using the old password.
    • A user typing the wrong password repeatedly (caps lock, keyboard language). Ask the user to update the password everywhere, then unlock once more.
  7. Test: have the user sign in on the computer and on webmail. Confirm they can reach what they need.
  8. Local Linux account: 
    sudo passwd username              # set a new password (prompts twice)
sudo passwd -e username           # force a change at next login
sudo faillock --user username     # show failed attempts (RHEL/Fedora-style PAM)
sudo faillock --user username --reset   # clear the lockout
    (Other distributions may use different lockout tools; check the documentation for yours.)

Escalate when

  • Lots of failed sign-ins from unusual places, or sign-in alerts the user didn't cause (possible compromise; this is a security incident).
  • You can't verify the user's identity.
  • The account is an administrator, executive or service account: don't reset it without approval, because a service may stop working.
  • The account keeps locking and you can't find the source after checking the user's devices.
  • You don't have the permissions to unlock the account.

Ticket note template

Issue: Account locked / password forgotten / password expired for <username>
Identity verified by: <method> (do NOT record secrets)
Account type: AD / Microsoft 365 / Linux local | Locked: Y/N | Expired: Y/N
Action taken: unlocked / reset password / forced change at next logon
Temporary password shared via: <method> (never write the password here)
Cause of lockout (if found): old password on phone / mapped drive / other / unknown
Verified user can sign in: Y/N
Follow-up: user to update saved passwords on <devices> | escalated to:

View as Markdown

How to use this

  1. Search first. Type what the user is describing, like printer offline or locked out. The search reads the whole text of every runbook, not only the titles.
  2. Narrow it down if you want to. The topic links under the search box (Windows, Network, Accounts and so on) trim the list. Click one again, or pick All, to go back.
  3. Open a runbook and read down the page. Symptoms tell you if you are in the right place. Before you start lists the quick questions. Then work through Steps in order, simplest first.
  4. Know when to stop. The shaded Escalate when box lists the signs that it is time to hand the ticket on. If any one of them matches, stop and escalate.
  5. Copy the ticket note. The last section has a note template. Press Copy, paste it into your ticketing system, and fill in the blanks.
Words you will see
Runbook
A written set of steps for one kind of problem, so you do not have to work it out from scratch each time.
First-line support
The first person a user talks to. Fixes the common problems and passes the rest on.
Escalate
Hand a ticket to someone with more access or experience, with notes so they do not have to start over.
Scope
How many people or devices are affected. One laptop and the whole office are very different problems.
Ticket note
A short written record of what was reported, what you tried and what happened.

Why I built this

I'm a computer science student in Toronto and I'm looking for junior IT support and help desk roles. When I started practising troubleshooting, I noticed I knew a lot of individual fixes but not a calm order to try them in, or when to stop and hand a problem on.

So I wrote these twelve runbooks to put that in order for myself, and I built this site so they are easy to search and read. They come from public vendor documentation and common help desk practice. They are not copied from a workplace and they are not real tickets.

They are still a work in progress. If a step looks wrong or something is missing, I would like to know.