How to unlock locked-out accounts in AD without PowerShell

In Active Directory (AD), a user account lockout occurs if the wrong password is entered several times within a certain interval of time. Usually, the account is locked by the domain controller for several minutes, during which the user cannot log in to the AD domain. After the amount of time configured in the account lockout policy passes, the user account is automatically unlocked. The purpose of setting up a user account lockout policy in AD is to prevent hackers or malicious insiders from gaining access to usersÕ accounts by guessing the credentials.

While account lockouts are generally attributed to brute-force attacks, there are other reasons why a lockout could happen:

• If replication fails between DCs
• If obsolete credentials are stored in the cache of applications or Terminal Services sessions
• If a user logs in to multiple devices at the same time and the password is changed on one of them

Here are a few ways ManageEngine ADManager Plus will help you manage AD users with locked-out accounts.

Step 1: Identify locked-out accounts in AD

The first thing you want to do is identify the user accounts that have been locked out. ADManager Plus offers a built-in report containing the list of locked-out users in any specific domain or OU. This report can be exported in multiple formats, or you can schedule the report to be periodically sent to your inbox. The dashboard on the homepage of the tool will also show you the number of locked-out user accounts.

Step 2: Unlock the user accounts in bulk

Once the locked-out users in AD have been identified, the next step is to unlock the accounts. ADManager PlusÕ bulk user management capability gives you the flexibility to unlock the accounts of multiple users in a desired domain or OU with the help of a CSV file. You can even configure the tool to identify the locked-out users and unlock them all automatically.

Step 3: Delegate, yet stay in control

The instant reports on locked-out accounts in AD and bulk AD account unlock operations certainly simplify the lives of IT administrators. In addition to those features, ADManager Plus also facilitates delegation of IT requests to other IT or non-IT users. With the help of audit reports, techniciansÕ actions can be monitored to prevent any unauthorized activity.

 

Need Features? Tell Us
If you want to see additional features implemented in ADManager Plus, we would love to hear. Click here to continue