The user account has been locked because there were too many logon attempts or password change attempts

Question

Following a previous Windows VM crash and the setup of a new VM by Microsoft Support, we are encountering the issue mentioned above. The VM is accessed by a single user, and there are no signs of multiple login attempts or incorrect password entries. However, we continue to experience lockouts for approximately one hour in the morning and evening. It disrupts our work.

Could you please provide an effective solution and suggest security measures to help prevent this issue? We are unsure of the cause and would greatly appreciate your assistance. Thank you.

Answer 1

Hi Suraj3D,

I have shared troubleshooting steps that I felt will help resolve the issue you reported.

Use Event Viewer on the VM to check for logs related to account lockouts. You can do this by going to the Event Viewer and looking for events with event ID 4740 or 4625, which indicate a locked out account or failed login attempts, respectively.

As you are using a local admin account is being used, cached credentials on your local machine or within the Remote Desktop Client may still be trying to use outdated login details. In Windows, go to Control Panel > User Accounts > Credential Manager, and delete any saved credentials that could be conflicting with your current login.

The previous password change might not have been updated everywhere, leading to conflicting login attempts using cached or stored credentials. Check all devices or services (such as Remote Desktop, browsers, or any services running on the VM) that might still be trying to log in with the old credentials.

Please make sure that you are entering the correct password when logging in. If you're unsure, you can reset your password through your organization's password reset process.

If you still find any difficulties, please let me know I would like to work closer on this issue.

Thank you.