Return
-
Title
"User Account unlocked" event records that a user unlocked their own account -
Description
"User Account unlocked" event records that the user account that was unlocked is the same account that unlocked the account. The user could be an administrative account or could be a user that is a non-administrative account and does not have permissions to unlock their own account. -
Cause
The time specified in the "Reset account lockout counter after" group policy item has expired and the user account is automatically unlocked. The unlock does not take effect until the locked-out user successfully logs-in with the correct credentials. When the user logs-in an event is generated that displays the user as the "Who" that unlocked the account. -
Resolution
This is expected processing.