Find Locked out Accounts in Active Directory

Locked out accounts are one of the most common Active Directory issues. In this guide, I’ll show you how to find locked out accounts in Active Directory using PowerShell, the AD Pro Toolkit, and Active Directory Users and Computers. I’ll also cover how to check the lockout status for a single user and all users.

Find Locked Out Accounts with PowerShell

In this example, I’ll use the Get-ADuser PowerShell cmdlet to check if a user is locked. This will display the value (True or False) for the LockedOut property.

Get-ADUser robert.allen -Properties * | Select-Object LockedOut

If you want to find all currently locked AD users run this command.

Search-ADAccount -LockedOut

In the screenshot above you can see I have two accounts that are locked out.

If you want to find all locked accounts for enabled users only use this command.

Search-ADAccount -lockedout | where-object {$_.enabled -eq 'True'}

Find Locked Out Accounts using AD Pro Toolkit

With the AD Pro Toolkit, you can quickly find all locked users with a single click.

1. Open Users > Password Reset & Unlock Tool
2. Click “Get Locked Users”
3. If you have any locked accounts, they will display along with lockout details.
4. You can also unlock the account and reset the users password from this same tool.

If you want to check the lockout status of a specific user, enter their username and click search. In the example below, I searched for the user bob.

Check if a Single AD Account is Locked

To check if an account is locked in Active Directory follow these steps:

1. Open ADUC
2. Open the user account you want to check
3. Click the Account tab
4. If the account is locked it will say “Unlock account. This account is currently locked out on this Active Directory Domain Controller”.

Why an AD Account Keeps Locking Out

One of the most frustrating Active Directory issues is when a user account keeps getting locked out. This is usually caused by stale cached credentials, a service running with an old password, mapped network drives, or mobile devices syncing with expired credentials.

1. To find why an account keeps locking out, log into your domain controller, open event viewer and filter for event ID 4740.
2. Look at the caller computer. This will be the source of the account lockout.
3. Check this computer for stale mapped drives, running services or other cached credentials.
4. For a detailed walkthrough, see my guide on Account Lockout Event IDs.

If you don’t want to dig through Event Viewer, the AD Pro Toolkit makes this easier, just open the Lockout Troubleshooter tool and click scan. This tool shows you the source computer, lockout time, and how many times the account has been locked in the last x days.

No PowerShell or Event Viewer needed. Try it free for 14 days. Download Free Trial

Schedule Locked Out Account Reports

Instead of manually checking for locked out accounts, you can schedule automatic reports. The AD Pro Toolkit lets you create a scheduled report that runs daily (or any interval) and emails you a list of all accounts that were locked out. This is useful for catching repeated lockouts early and identifying patterns before users start calling the help desk.

• Click on Scheduled Reports
• Click “new Schedule” and select reports
• Select users > Lockout Out Users
• Select Frequency (Daily, weekly, monthly)
• Enter email subject and recipients
• Click “Add Schedule”

Summary

In this guide, I showed you two options on how to find locked user accounts in Active Directory. The PowerShell Search-ADAccount cmdlet is a very easy way to display all the locked users in your domain. If you want an alternative to PowerShell and something that has more options then check out the AD Pro Toolkit. The GUI toolkit is very user friendly and requires no PowerShell experience.

Related: Find User accounts with passwords set to never expire