Windows Windows Needs an admin

0xC0000234: Event ID 4625 account locked out

Likely causes

• Too many wrong passwords hit the domain's account lockout threshold.
• A device or service keeps using an old password and locks the account again.
• A password guessing attack.

How to fix it

1. On a domain controller, find Event ID 4740 in the Security log. Its Caller Computer Name shows which machine caused the lockout.
2. On that machine, find what uses the old password: services, scheduled tasks, mapped drives, saved credentials, or a phone.
3. Unlock the account (in Active Directory Users and Computers, or Unlock-ADAccount -Identity <username>). This needs account admin rights.
4. Reset the password if the user doesn’t know it, and update it on every device.
5. If the source is unknown, don’t just keep unlocking. Escalate as a possible attack.

Checked against: learn.microsoft.com, learn.microsoft.com, learn.microsoft.com