A locked Windows account, a disabled account and a forgotten password need different fixes. Start by reading the exact sign-in message and checking whether you use a local account, a Microsoft account or a work or school account. Do not assume every lock clears after 30 minutes.
Windows 10 and Windows 11 have different sign-in options for local, Microsoft and work accounts. The available administrator tools also depend on your Windows edition.
Match the message to the problem
| Situation | Next step |
|---|---|
| Too many wrong-password attempts | Stop retrying. Check the lockout policy or ask the account administrator. |
| Account is disabled | An authorised administrator needs to check whether it should be enabled. |
| You forgot a local-account password | Use the security-question or other supported local recovery route. |
| A Microsoft-account sign-in is blocked | Use Microsoft’s online sign-in or password-recovery help. |
| A work or school account is locked | Contact the organisation’s IT team; local PC settings may not control that account. |
| Windows Hello PIN fails | Check PIN recovery or another sign-in option; a PIN is not the account password. |
How long does the lockout last?
Microsoft’s lockout-duration guidance explains that the time depends on policy. A duration of zero means an administrator must unlock the account. A fixed “wait 30 minutes” rule is therefore unreliable.
Stop guessing passwords. Check Caps Lock, keyboard layout and the selected account before trying again. Repeated attempts, including saved passwords used by another app or device, can keep causing problems.
Use another authorised administrator for a local account
If someone has a working administrator account on that PC, they can check local user properties. On editions that include it, lusrmgr.msc opens Local Users and Groups. The administrator can inspect the affected user and clear the lockout where that control is offered.
This tool is not available in every Windows edition, and it does not unlock a Microsoft online account or the organisation’s directory account. On a managed PC, let IT use the appropriate account-management tools.
Does net user /active unlock an account?
No: enabling a disabled account is different from clearing a failed-sign-in lockout. Microsoft’s net user reference defines /active:yes as enabling an account. It should not be presented as a universal unlock command.
An administrator can inspect a local account first:
net user "USERNAME"Replace USERNAME with the account name. If the actual problem is an account that was disabled, and enabling it is authorised, the setting is:
net user "USERNAME" /active:yesThese commands are not a way to recover an unknown password. Do not enable unfamiliar system or service accounts just because they appear in the list.
Recover a forgotten password through the right service
- Local account: follow Microsoft’s local-password recovery guide. Use the available security questions or an existing supported recovery method.
- Microsoft account: use the Microsoft-account password reset and its identity checks.
- Work or school account: use your organisation’s recovery service or IT support.
The earlier article’s “100% recovery” and “no trace” promises for offline unlocking tools were not dependable support guidance. Avoid editing account databases or clearing passwords as a routine first fix, especially when encrypted files or a managed device are involved.
Before a Windows reset, understand what it removes and make sure you have needed backups and recovery information. For Windows command-line account basics, see our account-management command guide.
Information checked October 13, 2026, using the guides linked above.