how to unlock ad accounts in bulk with powershell
Unlocks multiple locked Active Directory accounts with PowerShell safely. Covers finding locked accounts, bulk unlock, and investigating the cause. Use after mass-lockout events. Not for routine single unlocks (use ADUC).
TL;DR
Find locked accounts with Search-ADAccount -LockedOut, review the list, then pipe to Unlock-ADAccount. Investigate the common cause before unlocking in bulk; a mass lockout has a mass cause (usually a service or a password spray), and unlocking without fixing it just repeats.
The error
(Many accounts locked at once, e.g. after a service password change or an attack.)Steps
- Find them:
Search-ADAccount -LockedOut | Select Name, SamAccountName. Expected: list. Review it; bulk unlock the wrong accounts and you have undone a security control. - Investigate the common cause: check 4740 events for the caller machines. Expected: pattern found. One service with an old password explains fifty lockouts.
- Fix the cause first: update the service credential, stop the misbehaving script, or confirm the attack is over. Expected: fixed. Unlocking before this is futile.
- Unlock:
Search-ADAccount -LockedOut | Unlock-ADAccount. Expected: unlocked. For a subset, filter first and unlock only those. - Monitor for relocks over the next hour. Expected: none. Relocks mean the cause is still active.
When to use
- Mass lockout events
- Post-incident cleanup
When not to use
- Single lockouts (ADUC is fine)
- Lockouts under active attack (keep them locked)
Compatibility
- ActiveDirectory PowerShell module; delegated unlock rights
Variants
Exclude service accounts
Filter them out and handle separately; their fix is the credential update, not the unlock.
Scheduled bulk check
A scheduled task can report locked accounts, but auto-unlock is risky; keep a human in the loop.
Why it happens
Mass lockouts have mass causes. The PowerShell is trivial; the discipline is investigating first and unlocking second.
Edge cases
- Document the cause and the unlock list; auditors ask about bulk security changes.
- If the cause was an attack, coordinate with security before unlocking anyone.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_tyVGuNtnkLTWBshQdzhCFw
Maintainer review
No maintainer verification is recorded for this version.
This records the version a maintainer checked. It does not assert that the version is the latest upstream release.