The referenced account is currently locked out and may not be logged on to: how to fix it

The referenced account is currently locked out and may not be logged on to means Windows counted too many wrong passwords and blocked the account for a while. It is a security policy, not a fault. Stop typing passwords, wait out the lockout, then sign in once with the right password, or ask whoever manages the PC to unlock it.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2, local accounts and domain accounts, read against Microsoft's account lockout documentation.

What "The referenced account is currently locked out and may not be logged on to" means

Windows keeps a count of failed sign-ins for each account. Microsoft's page on the Account lockout threshold setting says that when the count passes the set number, the account is locked and cannot be used until an administrator resets it or until the Account lockout duration runs out. The message is how Windows tells you this, word for word: The referenced account is currently locked out and may not be logged on to.

The password itself is not changed or deleted. Your files are untouched. Once the lock ends, the same password works again, as long as it is the right one.

What causes the referenced account to be locked out, from the most common

The direct cause is always the same: too many failed sign-ins. What differs is who or what made them. The ranking is our reading of Microsoft's notes and user reports, not a statistic.

Microsoft names the less obvious sources itself: an app whose connection drops repeatedly can count every retry as a failed sign-in, and Kerberos can retry sign-ins on its own during encryption negotiation. It also notes that a wrong password typed to unlock a locked workstation counts toward the lockout.

How to fix "The referenced account is currently locked out and may not be logged on to"

Start with what costs nothing. You are done when Windows accepts your password and the message does not come back after an hour of normal use.

Fix 1. Stop trying and wait out the lockout duration

10 minutes or moreLow riskEveryone, first. Especially a home PC with a local account, where the default lock ends by itself.

Microsoft says a locked account unlocks when the Account lockout duration expires. On new Windows 11 22H2 setups that is 10 minutes. Every new wrong try during the wait only feeds the count again.

1. Leave the sign-in screen alone. Do not type any password now.
2. Wait at least 10 minutes on a home PC. On a work PC wait as long as IT told you, or ask (Fix 2).
3. Check Caps Lock and Num Lock, and the language code such as ENG in the corner of the sign-in screen.
4. Type the password once, slowly, and press Enter.

Fix 2. Ask IT to unlock a work or school account

5 minutes to ask, then as long as IT needsLow riskThe PC belongs to an employer or school, signs in to a domain, or uses a work account in Microsoft Entra ID (formerly Azure AD).

For a domain or Entra ID account the lockout lives on the organisation's servers. Microsoft says a locked account stays unusable until an administrator resets it or the duration expires, and only IT knows the duration they set.

1. From a phone or another computer, contact your help desk.
2. Give them your user name and the exact message: The referenced account is currently locked out and may not be logged on to.
3. Tell them if you changed your password recently and on which devices you use the account.
4. Ask them to unlock your account and, if it locks again, to check event 4740 for the computer that caused it.
5. When they confirm, sign in once with the current password.

Event 4740 is logged every time a user account is locked out, on domain controllers for domain accounts. Its Caller Computer Name field shows the computer the failed tries came from, which is how IT finds a phone or an old session still using an old password.

Fix 3. Reset a forgotten password the supported way

5 to 10 minutesLow riskYou do not remember the password and kept guessing.

Waiting does not help if the password is wrong. A reset proves who you are with the account itself and stops new failed tries from piling up.

1. Microsoft account: on the sign-in screen select I forgot my password, or reset it on Microsoft's account recovery page from another device.
2. Sign in to this PC once, online, with the new Microsoft account password.
3. Local account: after a wrong password Windows shows Reset password. Answer your security questions or insert the password reset disk you made earlier.
4. Work or school account: use your organisation's password reset page or ask IT (Fix 2). Windows cannot reset it locally.

Fix 4. Remove saved old passwords from Credential Manager

5 minutesLow riskThe account locks again soon after an unlock, usually after a password change.

Windows Credential Manager stores passwords for network shares, Remote Desktop and some apps. After a password change those entries keep sending the old password, and each attempt is a failed sign-in that counts toward the lockout.

1. Sign in once the account is unlocked (Fix 1 or Fix 2).
2. Press Win + S, type Credential Manager and open it.
3. Select Windows Credentials.
4. Expand each entry that uses your account name or a work server name.
5. Select Remove and confirm with Yes.
6. Restart the PC, then open the shares or apps again and type the current password when asked.

Fix 5. Disconnect mapped drives and network shares that use the old password

5 minutesLow riskThe message appears when you open a shared folder or a mapped drive, or the account locks after a password change.

A mapped drive reconnects at every sign-in with the credentials saved when it was mapped. Microsoft notes that when a connection drops repeatedly, every failed retry counts toward the threshold.

1. Press Win + R, type cmd and press Enter.
2. Type net use and press Enter to list the connected drives and shares.
3. Remove one connection with net use Z: /delete, using its letter, or all of them with net use * /delete.
4. Restart the PC.
5. Map the share again in File Explorer > This PC > Map network drive and enter the current password when asked.

net use
net use * /delete

Fix 6. Unlock a local account from another administrator account

5 minutesLow riskA home or small office PC with a second administrator account that still signs in. Windows Pro, Enterprise or Education.

Microsoft says a locked account can be used again once an administrator resets it. Local Users and Groups shows the lock as a box on the account, so an administrator can clear it without waiting.

1. Sign in with the other administrator account.
2. Press Win + R, type lusrmgr.msc and press Enter.
3. Select Users, right-click the locked account and select Properties.
4. On the General tab clear Account is locked out.
5. Select OK, sign out, and sign in to the unlocked account once.

Windows Home does not include Local Users and Groups. On Home, wait out the lockout (Fix 1) instead.

Fix 7. Check the lockout policy on your own PC, without turning it off

5 minutesRead the warningYou own the PC, you are an administrator, and the lockout is shorter or stricter than you want. Not on a PC that IT manages.

The threshold and the duration decide how quickly the message appears and how long it lasts. Microsoft's baseline is 10 tries, 10 minutes and 10 minutes, which allows typing errors and still stops password guessing.

1. Press Win + R, type secpol.msc and press Enter.
2. Open Security Settings > Account Policies > Account Lockout Policy.
3. Read the values of Account lockout threshold, Account lockout duration and Reset account lockout counter after.
4. To change one, double-click it, enter the new number and select OK. Microsoft says no restart is needed.
5. Keep the threshold above 0. Microsoft's baseline is 10.

Windows Home does not include secpol.msc. There, net accounts in an administrator Command Prompt shows the same three values.

If you are still locked out: where the cause is written and who can help

If the account locks again after every unlock, something is still sending a wrong password. Windows records each lockout as Security event 4740: A user account was locked out. For a domain account it is on the domain controller, for a local account in this PC's Security log, if account management auditing is turned on.

• Read the event: in Event Viewer > Windows Logs > Security filter for event ID 4740. The Caller Computer Name field names the computer the failed tries came from.
• Work or school account: send IT the time of the lockout and the devices you use. They can read 4740 on the domain controller.
• Local account, no other administrator, no reset option: there is no supported way around the sign-in. Resetting Windows from the recovery screen is the way back. It needs the BitLocker recovery key on an encrypted PC.
• Before any reset: copy your files out if another account still signs in. Step by step: Back up your files (Windows Backup, File History, Time Machine).
• A computer name you do not know in event 4740 means someone else is trying the account. Change the password from a safe device and tell IT.

How to keep the account from being locked out again

• After a password change, update it at once on every phone, mail app, PC and mapped drive that uses the account (Fix 4 and Fix 5).
• Lock the PC with Win + L when you leave it, so nobody tries passwords on it.
• Check Caps Lock and the keyboard layout before you type at the sign-in screen.
• Set up a recovery route now: a Microsoft account with a current phone and email, or security questions for a local account.
• Keep a second administrator account on a home PC, so you can free the first one (Fix 6). Step by step: Create a new user account to test a problem.
• Keep the lockout on. A threshold of 10 forgives typing slips and still stops guessing.

Frequently asked questions

What does it mean when the referenced account is currently locked out?

It means Windows counted more failed sign-ins for the account than its Account lockout threshold allows, so it blocked the account for a while. The password is not deleted and your files are safe. The account becomes usable again when the Account lockout duration runs out or when an administrator unlocks it. Until then, every try shows the same message, even with the right password.

How long is a referenced account locked for?

As long as the Account lockout duration says. On new Windows 11 22H2 setups Microsoft sets it to 10 minutes, after 10 wrong tries within 10 minutes. A work or school PC uses whatever IT chose, which can be longer or even until an administrator unlocks it. On your own PC with Windows Pro you can read the value in secpol.msc, on Home with net accounts.

How long does Windows 11 lock you out for a wrong password?

With the defaults Microsoft applies to new Windows 11 22H2 and later setups, 10 minutes after 10 wrong passwords within 10 minutes. After that the account unlocks by itself. PCs that were set up earlier and only updated later may have no lockout at all, and work PCs follow their organisation's policy. A Windows Hello PIN has its own separate lockout.

Why is my account locked out when I typed the right password?

Because during the lockout Windows refuses every sign-in, right or wrong. Wait out the duration, then type the password once. If the account locks again soon after, something else sends an old password: a saved credential, a mapped drive, a phone with work mail or another PC. Remove saved credentials (Fix 4) and reconnect mapped drives (Fix 5).

The referenced account is currently locked out with Azure AD: what do I do?

On a PC that signs in with a work account in Microsoft Entra ID (formerly Azure AD) the lock is held by your organisation, not by this PC. Nothing on the PC can lift it early. Wait, then use your organisation's password reset page if you forgot the password, or ask IT to lift the lock and to find the device that keeps sending a wrong password.

Why do I see this error when I open a network share?

The share asks the server to check your account, and the server's domain says it is locked. Often the reason is the share itself: a mapped drive or a saved credential still uses an old password and retries at every sign-in. Disconnect it with net use * /delete, remove old entries in Credential Manager, restart and map the drive again with the current password.

Should I set the account lockout threshold to 0?

No, not on a home PC. A value of 0 means the account never locks, which removes the protection against password guessing. Microsoft says to choose 0 only when every password is complex and at least eight characters long and an audit alerts on failed sign-ins. Its own baseline is 10 tries, which forgives typing slips. Change the threshold only on a PC you own.

Can I unlock my account without another administrator?

On a home PC, yes, by waiting: the lock ends when the duration runs out. Early unlocking needs an administrator, either another admin account on the PC (Fix 6) or IT for a work account. If you also forgot the password, use the reset options in Fix 3. Without any of these, resetting Windows is the remaining supported route.

What is a reference account or an account reference?

Some searches for reference account or account reference are about a reference number on a bill or a bank account. This page is about something else: the Windows message The referenced account is currently locked out and may not be logged on to, where referenced account simply means the account you tried to sign in to.