User report
"Hi, I can't log in, it says my account is locked. I have a client call in 20 minutes."
jsmith, Front Desk
Triage
One user, blocked from working, with a call in 20 minutes, so High priority. I confirmed who they were by calling back on the number in the directory before touching the account.
Troubleshooting
-
Checked the account in Active Directory: locked, with 5 bad password attempts.
Get-ADUser jsmith -Properties LockedOut, BadLogonCount -
Searched DC01's Security log for Event ID 4740: the lockout came from WS01.
-
Asked whether they'd changed their password recently: yes, yesterday. Their phone still had the old password saved for email.
Resolution
Unlocked the account, had the user update the saved password on their phone, and confirmed they could sign in.
Unlock-ADAccount jsmith
Root cause
An old password cached on a second device kept retrying and triggered the lockout policy.
Prevention
Added an "update your password everywhere" step to KB-003 and sent the user the link.
Note to user
You're unlocked. Your phone was still using your old password, which caused the lock. I've sent a short guide on updating it so this won't happen again.