---
title: Unlocking user accounts
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

The accounts of administration interface users can be locked for one of the following reasons:

- The user's [password expires](https://docs.kentico.com/13/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/password-expiration.md).
- The user reaches the limit of [invalid sign-in attempts](https://docs.kentico.com/13/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/invalid-sign-in-attempts.md).

The following text describes how you can provide users with means to unlock their accounts.

## Password expired

When an account is locked due to password expiration, the system asks the user to change their password in order to unlock the account. You can find more information in [Password expiration](https://docs.kentico.com/13/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/password-expiration.md).

Alternatively, administrators can [extend the password's validity](https://docs.kentico.com/13/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/password-expiration.md#extending-password-validity).

## Invalid sign-in attempts exceeded

When an account is locked due to an exceeded number of [invalid sign-in attempts](https://docs.kentico.com/13/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/invalid-sign-in-attempts.md), administrators can reset the invalid sign-in attempt counter manually:

1. Open the **Users** application.
2. Edit the given user.
3. Click **Reset** next to the **Invalid sign-in attempts** field.

To allow users to unlock their own accounts, you need to utilize _**unlock emails**_. You can set up the following options via the settings in **Settings -> Security & Membership -> Protection**:

- Automatic email notification when the sign-in attempt limit is exceeded – enable the **Send unlock account email** setting.
- Messages that inform about locked accounts during sign-in and allow users to request an unlock email – enable the **Display account lock information message** setting.

  > **Note:** **Note**: Displaying account lock information on sign-in is not recommended, because it can inform potential attackers that a user account with a given username exists and is locked.

The content of the emails is based on the **Membership - User account locked** [email template](https://docs.kentico.com/13/configuring-xperience/managing-email-templates.md). The template must contain a link to an account unlock page – to generate a valid URL of the unlock page for the email's recipient, use the _{% UnlockAccountUrl %}_ macro.