---
title: Unlocking user accounts
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

A user account can be locked for one of the following reasons:

- The user's [password expires](https://docs.kentico.com/k82/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/password-expiration.md).
- The user reaches the limit of [invalid logon attempts](https://docs.kentico.com/k82/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/invalid-logon-attempts.md).

The following text describes how you can provide users with means to unlock their accounts.

## Password expired

When an account is locked due to password expiration, the particular user will be asked to change their password in order to unlock their account. You can find more information in the [Password expiration](https://docs.kentico.com/k82/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/password-expiration.md) topic.

Alternatively, you can [extend the password's validity](https://docs.kentico.com/k82/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/password-expiration.md#extending-password-validity).

## Invalid logon attempts exceeded

When an account is locked due to exceeding the number of invalid logon attempts, the particular user will have to manually unlock their account. You can enable them to do that by directing them to the _\~/CMSModules/Membership/CMSPages/UnlockUserAccount.aspx_ page.

Alternatively, you can create a custom page for unlocking accounts, on which you can place one of the following components:

- **Unlock user account** web part - a web part you can use in the Portal engine development model.
- **UnlockUserAccount** control - an alternative to the Unlock user account web part, which can be placed on an ASPX page. The control is located in _\~/CMSModules/Membership/Controls/UnlockUserAccount.ascx_.

## Notifications

You can then specify whether you want users to receive an e-mail notifying them that their account has been locked in the **Send unlock account e‑mail** setting in **Settings -> Security & Membership -> Protection**. The notification e‑mail uses the **Membership - User account locked** template. You can insert a link to the account unlock page with the _{% UnlockAccountUrl %}_ macro.

Users can also be notified directly when logging in. To enable this option, set the **Display account lock information message** setting to true. However, enabling this feature is not recommended, since it can reveal to a potential attacker the fact, that they've managed to lock a user's account.