Locked user account keeps locking
Documentation: Microsoft Learn
Work the problem
Unlocking is temporary
Fictional case: An account locks again every fifteen minutes. The user has already corrected their interactive password.
Reasoning notebook
Record the evidence that supports your answer and the check you would run next. Your notes stay in this browser — nothing is uploaded.
Why it happens
Lockout counters accumulate failures from every source, so a cached password held by a service, a scheduled task, or a phone mail profile keeps submitting the old credential after a reset. Each of those retries on its own schedule, which is what makes the interval between lockouts look random. The account is fine; something else is holding a stale secret.
Check this first
What to look for
A recurring interval suggests a task, service, mapped connection or another client using stale credentials. Use event evidence to find the source.
Working through it
- Pull event 4740 records from the PDC emulator and read the Caller Computer Name in each one.
- Examine events 4771 and 4625 on that caller to identify which process or service is presenting the credential.
- On the named machine, check service logon accounts, scheduled task credentials, and Credential Manager entries.
- Have the user remove and re-add the account on any mobile device syncing mail.
- Reset the password once the source is corrected so the counter starts from a clean state.
Avoiding it next time
Verify the repair: After correcting the identified credential source, monitor beyond the previous recurrence interval and confirm successful authentication.