Find locked-out users
Documentation: Microsoft Learn
Search-ADAccount -LockedOut asks the directory for accounts currently in a locked state, so the selection happens server-side with no client filtering involved.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Search-ADAccount -LockedOut | Select-Object SamAccountName,Name,ObjectClass- Stage 1Search-ADAccount
-LockedOut - Stage 2Select-Object
Positional values or no named parameters
How it works
Search-ADAccount -LockedOut asks the directory for accounts currently in a locked state, so the selection happens server-side with no client filtering involved. Select-Object keeps the SAM account name and display name alongside ObjectClass, which distinguishes a user object from a computer.
Adapting it
Once the cause is confirmed, chain Unlock-ADAccount onto the same pipeline to clear them in bulk. Adding -UsersOnly to Search-ADAccount removes computer objects when they are cluttering the result.
Requirements
ActiveDirectory module; unlocking additionally requires delegated rights.
If the result is unexpected
An expected locked account is missing or the result changes between queries.
Lockout state can change after an unlock and may differ across domain controllers during replication.
- Query the intended domain controller and record the observation time alongside the account identity.
Validate the result
The reported state agrees with the selected controller at the time of the check.
Keep the check reliable
Use time-stamped observations and investigate recurring lockouts separately from current state.
