SERVER-032 · Script
Unlock User Account
Unlocks locked-out directory or local accounts, either the ones you name or every locked account.
Version 1.0.0Language PowerShellUpdated November 2026
What it does
Two scopes: Directory domain accounts (default)
- Local: local accounts on the computer the script runs on
Choose the accounts with -Identity, or use -AllLocked to unlock every account that is locked right now (for Directory, optionally only within -SearchBase). Preview mode (default) lists what it would unlock. Apply unlocks the accounts. Passwords are not changed. If an account locks again soon, find the source with SERVER-023.
Requirements
Windows PowerShell 5.1. Directory scope: the ActiveDirectory module (RSAT) and rights to unlock the accounts.
How to run it
- Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
- Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
- Script type: PowerShell 5.1, 64-bit
- User interaction: none; the script never prompts
- Timeout: 30 minutes for large directories or many servers
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| Mode | Preview (default) or Apply. | Preview, Apply | Preview |
| Identity | Accounts to unlock. | (none) | |
| AllLocked | Unlock every locked account instead of a named list. | False | |
| Scope | Directory (default) or Local. | Directory, Local | Directory |
| SearchBase | With -AllLocked and Directory scope, only unlock accounts in this OU (distinguished name). | ||
| Server | Optional domain controller to use for every change. |
Exit codes
- 0 = All accounts unlocked, nothing to unlock, or Preview
- 1 = Some accounts were not found or could not be unlocked
- 2 = Script error (see log)
Testing steps
- Run it first with the mode set to Preview on one test OU, test account or test server. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Preview mode changes nothing. Unlocking does not change passwords. If an account should stay locked, disable it instead.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |