The user account has been locked because there were too many logon attempts or password change attempts

Question

Following a previous Windows VM crash and the setup of a new VM by Microsoft Support, we are encountering the issue mentioned above. The VM is accessed by a single user, and there are no signs of multiple login attempts or incorrect password entries. However, we continue to experience lockouts for approximately one hour in the morning and evening. It disrupts our work.

Could you please provide an effective solution and suggest security measures to help prevent this issue? We are unsure of the cause and would greatly appreciate your assistance. Thank you.

Answer 1

Hello @Suraj3D and @Toney Biegalski (IS)

I don't know if you still have the issue, but hope this will anyway help.

I believe most of the time the so-called answer written here by "Microsoft" experts completely miss the sense of the issue, and anyway are not able to give a valid answer.

I faced the same problem by myself and found a solution that worked, at least for me.

I was in the same condition: just 1 administrative local account (VM not joint to a domain) and locked out because of continuous flood of login tries with wrong password.

Since this lockout happens based on login tries, regardless on how strong is the password set, I find very stupid to have the admin lockout policy enabled by default, and I disabled it as soon as I gained control back.

Anyway, from the Azure page of the VM expand the "Help" menu item group and select "Reset password".

If you read carefully, this page is not only usable to change the password of an existing account (which is useless in lockout condition) but can also CREATE and BRAND NEW Administrative account.

Just put an username, twice the password and that's it. Use the new account to logon an disable the lockout password using the local security policy applet.

Good luck and please mark my answer as valid if you find it useful.

Answer 2

Hi Suraj3D,

I have shared troubleshooting steps that I felt will help resolve the issue you reported.

Use Event Viewer on the VM to check for logs related to account lockouts. You can do this by going to the Event Viewer and looking for events with event ID 4740 or 4625, which indicate a locked out account or failed login attempts, respectively.

As you are using a local admin account is being used, cached credentials on your local machine or within the Remote Desktop Client may still be trying to use outdated login details. In Windows, go to Control Panel > User Accounts > Credential Manager, and delete any saved credentials that could be conflicting with your current login.

The previous password change might not have been updated everywhere, leading to conflicting login attempts using cached or stored credentials. Check all devices or services (such as Remote Desktop, browsers, or any services running on the VM) that might still be trying to log in with the old credentials.

Please make sure that you are entering the correct password when logging in. If you're unsure, you can reset your password through your organization's password reset process.

If you still find any difficulties, please let me know I would like to work closer on this issue.

Thank you.