How to Use PowerShell to Find and Unlock Locked Active Directory Accounts

The Challenge of Locked Accounts

In enterprise Windows environments, Active Directory (AD) is usually configured with an Account Lockout Policy. If a user enters the wrong password too many times (typically 3 to 5 attempts), their account is automatically locked to prevent brute-force attacks. While this is great for security, it creates a massive volume of helpdesk tickets.

Instead of manually clicking through the Active Directory Users and Computers (ADUC) GUI to find out who is locked out and unchecking the “Account is locked out” box, system administrators can use PowerShell to find all locked accounts instantly and unlock them in seconds.

Step 1: Import the Active Directory Module

To run these commands, you must run PowerShell as an Administrator on a Domain Controller, or on a workstation that has the Remote Server Administration Tools (RSAT) installed. Open PowerShell and import the AD module:

Import-Module ActiveDirectory

Step 2: Find All Locked AD Accounts

To quickly generate a list of every single user in the entire domain whose account is currently locked out, use the Search-ADAccount cmdlet:

Search-ADAccount -LockedOut | Select-Object Name, SamAccountName

This command will output a clean table showing the user’s full name and their username. If the list is empty, no accounts are currently locked.

Step 3: Unlock a Specific User

If you identify a specific user from the list that needs to be unlocked (for example, a user with the username jsmith), you can unlock their account using the Unlock-ADAccount cmdlet:

Unlock-ADAccount -Identity jsmith

This command executes silently. If it returns to the prompt with no errors, the account was successfully unlocked.

Step 4: Unlock All Users Simultaneously (Use with Caution)

In rare situations—such as a malfunctioning script or a misconfigured Wi-Fi radius server causing hundreds of users to lock themselves out simultaneously—you might need to unlock everyone at once. You can achieve this by piping the search results directly into the unlock command:

Search-ADAccount -LockedOut | Unlock-ADAccount

Warning: Use this command carefully. If an attacker is actively brute-forcing accounts, running this command will reset their attempt counter and give them more opportunities to guess passwords. Always investigate the root cause of widespread lockouts before performing a mass unlock.