Skip to content

The referenced account is currently locked out and may not be logged on to.

The referenced account is currently locked out and may not be logged on to.

You may receive the following error after creating your Azure AD DS instance and when you try and join your Azure server to the newly created domain you receive the error.

There are a few options to test to try and sign in and complete the Azure AD DS domain join process.

You can you try and of the following:


For example, your username is your login will be\john

If the above does not work for you, you can then try the following, after creating your Azure AD DS instance you will have to reset your password.

For cloud-only user accounts, users must change their passwords before they can use Azure AD DS. This password change process causes the password hashes for Kerberos and NTLM authentication to be generated and stored in Azure AD. The account isn’t synchronized from Azure AD to Azure AD DS until the password is changed. Either expire the passwords for all cloud users in the tenant who need to use Azure AD DS, which forces a password change on next sign-in, or instruct cloud users to manually change their passwords.

Once the password for the user has been changed, you can attempt to join the domain again.

Graphical user interface, text, application

Description automatically generated

In the next article we will look at how to create GPO’s (Group Policies) using Azure Active Directory Domain Services.

Microsoft is aware of the known account lock out challenges with Azure AADDS, you can view the FAQ here: Troubleshoot account lockout in Azure AD Domain Services | Microsoft Docs

Sharing is caring!

Published inAzureAzure Active Directory Domain Services

One Comment

Leave a Reply

Your email address will not be published.