User constantly getting locked out

For a user whose account is being locked every 30 minutes and is suspected to be related to Outlook, focus on identifying repeated bad password attempts and any Outlook-specific credential issues.

1. Understand the lockout behavior

• In a Microsoft Entra Domain Services managed domain, by default 5 bad password attempts within 2 minutes will lock the account, and it automatically unlocks after 30 minutes. If something (user, Outlook, or another app/service) keeps retrying with a bad password, the account will repeatedly lock on this cycle.

2. Check for common lockout causes According to the documented common reasons:

• The user may still be using an old password after a recent password change.
• An application or service (such as Outlook, another mail profile, mobile device, or background service) may be using stored old credentials and repeatedly trying to sign in.
• The password may have been changed in a different environment (for example, on-premises AD vs. Entra) and synchronization delay could cause temporary lockouts if the user signs in before sync completes.

3. Focus on Outlook-related causes

• For Outlook 2016 specifically, there is a known issue where if a user types an incorrect credential and then cancels the password prompt, Outlook may continue sending requests with the incorrect credentials, causing account lockouts.
• The fix for this is to install the April 2, 2019 update for Outlook 2016 (KB4464502). After this update, Outlook 2016 is prevented from sending requests during “Need Password” by default.

4. Practical steps to troubleshoot

1. Verify lockout pattern

• Confirm that the lockouts align with the 30-minute automatic unlock window. This strongly indicates repeated bad password attempts from some client or service.

2. Identify where the bad credentials are coming from

• Check all devices and apps where this user’s account is configured (desktop Outlook, laptops, mobile devices, services, scheduled tasks, etc.) and ensure the current password is used everywhere.
• Remove or update any stored credentials that might still hold the old password.

3. Update Outlook

• If the user is on Outlook 2016, ensure that KB4464502 is installed so Outlook does not continue sending bad credentials after a canceled prompt.

4. Avoid raising thresholds

• The default lockout policy (5 bad attempts in 2 minutes, 30-minute lockout) is implemented via fine-grained password policy. It is not recommended to increase thresholds to “mask” the problem. Instead, identify and fix the source of bad sign-ins.

5. If using Microsoft Entra Domain Services

• Remember that fine-grained password policies apply only within the managed domain. Changing the policy does not unlock an already locked account; the account must either auto-unlock after the lockout duration or be handled per your admin process.

Once all clients and services are corrected to use the right password and Outlook is updated (if applicable), the repeated 30-minute lockout cycle should stop.

---

References:

• Troubleshoot account lockout problems with a Microsoft Entra Domain Services managed domain
• Troubleshoot account sign-in problems with a Microsoft Entra Domain Services managed domain
• An account locks out when you use an incorrect credential in Outlook 2016
• Outlook 2007 prompts you repeatedly for a password under certain network conditions

AI-generated content may be incorrect. Read our transparency notes for more information.