---
title: Password Reset and Account Lockout
category: Accounts
summary: A user forgot their password, their password expired, or their account is locked after failed sign-ins.
applies_to: Active Directory / Microsoft 365 (Entra ID) accounts, plus local Linux accounts
related: 07-outlook-microsoft-365-signin, 06-phone-wont-sync-email, 10-malware-cleanup-basics
---

## Symptoms

- "Your account has been locked out" or "Your password has expired".
- "The user name or password is incorrect" and the user is sure it's right.
- The account keeps locking again within minutes of being unlocked.
- User has forgotten the password and the self-service reset isn't available.

## Before you start: verify who is asking

**Never reset a password for someone you haven't verified.** Attackers phone help desks pretending to be staff. Follow your organisation's identity-check procedure. Typical examples are calling back on the number on file, confirming details only the user would know, or manager approval. If you don't have a procedure, ask your lead before resetting anything.

Also decide which of the three problems this is, because the fix differs:

| Problem | Typical sign | Fix |
|---|---|---|
| **Forgotten** password | User can't remember it | Self-service reset, or admin reset |
| **Expired** password | Message says expired | User sets a new one (or admin reset) |
| **Locked out** | Message says locked, or "too many attempts" | Unlock (wait for the timer or admin unlock), then find out why |

## Steps

1. **Verify identity** as described above and note how you verified (not the answers themselves).
2. **Try self-service first** if your organisation has it (for Microsoft 365, the user can use the "Forgot my password" link on the sign-in page if self-service password reset is enabled).
3. **Active Directory (on-premises):** open *Active Directory Users and Computers*, find the user, then:
    - *Unlock:* right-click the user > *Properties* > *Account* tab > tick **Unlock account** > OK.
    - *Reset:* right-click the user > *Reset Password*. Tick **User must change password at next logon**.
4. **Microsoft 365 admin center (cloud accounts):** Users > Active users > select the user > **Reset password**. Check the user isn't marked *Blocked from signing in* in the same panel.
5. **Share the temporary password securely** (phone call to a verified number, or your organisation's approved method). **Never put a password in a ticket, chat or email.**
6. **Find out why it locked** if it happens again. The usual culprits are old saved passwords on other devices:
    - Phone or tablet email still using the old password.
    - A second computer, a mapped network drive, a saved Remote Desktop connection or a scheduled task using the old password.
    - A user typing the wrong password repeatedly (caps lock, keyboard language).
    Ask the user to update the password everywhere, then unlock once more.
7. **Test:** have the user sign in on the computer and on webmail. Confirm they can reach what they need.
8. **Local Linux account:**
    ```
    sudo passwd username              # set a new password (prompts twice)
    sudo passwd -e username           # force a change at next login
    sudo faillock --user username     # show failed attempts (RHEL/Fedora-style PAM)
    sudo faillock --user username --reset   # clear the lockout
    ```
    (Other distributions may use different lockout tools; check the documentation for yours.)

## Escalate when

- Lots of failed sign-ins from unusual places, or sign-in alerts the user didn't cause (possible compromise; this is a **security incident**).
- You can't verify the user's identity.
- The account is an administrator, executive or **service account**: don't reset it without approval, because a service may stop working.
- The account keeps locking and you can't find the source after checking the user's devices.
- You don't have the permissions to unlock the account.

## Ticket note template

```
Issue: Account locked / password forgotten / password expired for <username>
Identity verified by: <method> (do NOT record secrets)
Account type: AD / Microsoft 365 / Linux local | Locked: Y/N | Expired: Y/N
Action taken: unlocked / reset password / forced change at next logon
Temporary password shared via: <method> (never write the password here)
Cause of lockout (if found): old password on phone / mapped drive / other / unknown
Verified user can sign in: Y/N
Follow-up: user to update saved passwords on <devices> | escalated to: 
```