Problem overview
In the aftermath of a lockout—whether triggered by a security event or an accidental account issue—IT pros often need a straightforward method to restore access for authorized users. This script simplifies that challenge by automatically enabling both local and domain user accounts (if applicable), returning systems to normal function quickly and reliably.
PowerShell 100s timeout Runs as Local system Windows
<#
This resource is provided as a convenience for Level users. We cannot
guarantee it will work in all environments. Please test before deploying
to your production environment. We welcome contributions to our community
library
Level Library
https://level.io/library/script-windows-unlock-device
#>
$script:errors = $false # Script-scoped error tracking
# Function to check if the device is domain-joined
function Is-DomainJoined {
$domain = (Get-WmiObject Win32_ComputerSystem).PartOfDomain
return $domain
}
# Function to unlock all local accounts
function Enable-LocalAccounts {
$localUsers = Get-LocalUser
foreach ($user in $localUsers) {
try {
Enable-LocalUser -Name $user.Name
Write-Host "Local account $($user.Name) has been unlocked."
} catch {
Write-Host "ALERT: Failed to unlock local account $($user.Name): ${_.Exception.Message}"
$script:errors = $true
}
}
}
# Function to unlock Active Directory accounts (only if domain-joined)
function Enable-ADAccounts {
try {
$adUsers = Get-WmiObject Win32_ComputerSystem | Select-Object -ExpandProperty UserName
if ($adUsers -and $adUsers -match '\\') {
foreach ($adUser in $adUsers) {
try {
# Extract just the username (DOMAIN\Username format)
$adUserName = $adUser -split '\\' | Select-Object -Last 1
Enable-ADAccount -Identity $adUserName -Confirm:$false
Write-Host ("AD account " + $adUserName + " has been unlocked.")
} catch {
Write-Host ("ALERT: Failed to unlock AD account " + $adUserName + ": " + $_.Exception.Message)
$script:errors = $true
}
}
}
} catch {
Write-Host ("ALERT: Failed to retrieve AD users: " + $_.Exception.Message)
$script:errors = $true
}
}
# Execute actions
Enable-LocalAccounts
# If the system is domain-joined, unlock AD users
if (Is-DomainJoined) {
Write-Host "Domain detected. Unlocking AD users..."
Enable-ADAccounts
} else {
Write-Host "No domain detected. Skipping AD account unlock."
}
# Exit with error if any issues occurred
if ($script:errors) {
Write-Host "ALERT: One or more accounts failed to unlock. Exiting with error."
exit 1
} else {
Write-Host "All necessary accounts have been unlocked successfully."
}
This script checks whether the device is joined to a domain and then proceeds to enable local Windows user accounts. If it detects domain membership, it also re-enables any related Active Directory accounts, effectively rolling back the account restrictions imposed by a prior lock-down procedure. It streamlines the entire unlock process without the need for complex manual intervention.
Use cases
- Reversing a security lockdown after an incident has been resolved
- Correcting unexpected or accidental user account lockouts
- Streamlining the process of restoring normal access during routine maintenance
- Re-enabling domain accounts on systems that were previously locked
Recommendations
- Test thoroughly in a non-production or test environment before deployment
- For on-demand unlocking, configure a script-based monitor in Level to trigger this script when needed
- If you want to run this script on a set schedule, build an automation in Level with a scheduled trigger to automate the unlock process
- Double-check which accounts should remain disabled before running this script to avoid unintentionally unlocking compromised accounts