Immediate
Locks again right after unlock
Look for a device, application, service, or saved credential continuously retrying the old password.
Everyday IT · Account Lockouts
Unlocking the account is not the fix.
If the user locks again, something is still submitting the wrong credentials.Find the source of the bad authentication attempt instead of repeating the unlock/reset cycle.
Start with the timing
When the lockout happens often tells you where to look.
At login
Occurs when Outlook, VPN, or another app opens
The application or saved session may be the trigger. Reproduce one action at a time.
At another location
Happens when the user gets home or visits another office
An old laptop, phone, VPN profile, remote session, or mapped resource may still be active there.
Overnight
No user action is required
Scheduled tasks, services, appliances, scripts, or background applications become more likely.
Common stale-credential sources
Search broadly before changing the password again.
Devices
Phones, tablets, old PCs
Forgotten devices can continue authenticating in the background long after the user stops actively using them.
Windows
Credential Manager and saved sessions
Remote Desktop, mapped drives, cached app credentials, and old browser or Office sessions can preserve outdated credentials.
Automation
Services and scheduled tasks
A service or task configured under the user account can silently retry a stale password.
Network tools
VPN and line-of-business applications
Some clients store credentials separately from Windows and continue retrying even after the user's primary password has changed.
Use evidence when the source is not obvious
Repeated resets destroy the pattern you are trying to understand.
Logs
Check the identity source
Use domain-controller security events, sign-in logs, VPN logs, or the relevant authentication system to identify when and where failures are occurring.
One change
Test one suspected source at a time
Remove or update one stale credential source, then verify whether the lockout stops before changing something else.
Verify
Prove the real workflow
Confirm Windows sign-in, Microsoft 365, VPN, mapped resources, or the affected app behaves normally after the source is corrected.
Escalate
When the origin is still unclear
Escalate when multiple identity systems are involved, service accounts are mixed with user credentials, or logs point to infrastructure you do not own.
Stop clearing the symptom. Find what keeps causing it.