PowerShell Check If Account Is Locked

Check if AD account is locked

To check if AD account is locked, use Get-ADUSer cmdlet and select LockedOut property using Select-Object cmdlet.
Here is the code:

Get-ADUser DELL -Properties * | Select-Object LockedOut

Lockout
-------
False

Replace DELL with the username for which you want to check if AD account is locked or not.

Get-ADUSer cmdlet is used to get specific user object and -Propeties to get all properties of the user object. Use Select-Object cmdlet to select Lockedout properties among all the properties. This property will tell if AD User account is locked or not.

Check if local user account is locked

Using the Get-WmiObject Cmdlet

Use the Get-WmiObject cmdlet to check if a user account is locked in PowerShell.

Get-WmiObject -Class Win32_UserAccount -Filter "Name='DELL'" | Select-Object Lockout

Lockout
-------
False

In this example, the Get-WmiObject cmdlet retrieved the management information about a Windows computer using the WMI (Windows Management Instrumentation) system. Here, the -Class parameter contains the value Win32_UserAccount to specify the WMI (Windows Management Instrumentation) class containing user account information. Then, the -Filter parameter filters the username of the user account we want to retrieve information about.

After that, the Select-Object cmdlet is used to select the Lockout property from the retrieved information. This property indicates whether the account is currently locked out or not.

Replace DELL with the username which is on your System.

The output will return True or False. If it’s True, it indicates that the account is locked. If it’s False, it indicates that the account is not locked. In the above case, the output is False, meaning that the user account with the username DELL is active, not locked.

In case you need clarification on the usernames. Run the below command to view the list of all user accounts on your system.

Get-WmiObject -Class Win32_UserAccount | Select-Object Name

Name
----
Administrator
DefaultAccount
DELL
Guest
WDAGUtilityAccount

You can observe there are 5 user accounts on my system with the names Administrator, DefaultAccount, DELL so on.

To get a list of all user accounts on a local or remote computer in PowerShell, you can also use the Get-LocalUser cmdlet.

Let’s take another user account to check whether it is locked.

Get-WmiObject -Class Win32_UserAccount -Filter "Name='Guest'" | Select-Object Lockout

Lockout
-------
False

We can observe the output is returned as False, which shows that the user account associated with the username Guest is also not locked.

Further reading:

Check if AD User exists in PowerShell

Read more →

PowerShell check if Software is installed

Read more →

Using the Net User Cmdlet

Use the Net User cmdlet to check if a user account is locked in PowerShell.

Net User 'DELL' | Select-String 'Account active'

Account active               Yes

In the above code, the Net User command is used to retrieve the status of the user account having username DELL. Here, the Select-String command filters the output to display only the line containing account status. For example, if the account is locked, the output will show Account active No. Here, the output returned as Account active Yes, meaning the user account DELL is not locked.

If you write the Net User alone without any parameter, it will display the list of all the user accounts.

Net User

User accounts for \\DESKTOP-B5****
-------------------------------------------------------------------------------
Administrator            DefaultAccount           DELL
Guest                    WDAGUtilityAccount
The command was completed successfully.

You can see the list of all user accounts on my system above.

That’s all about PowerShell check if account is locked.