“I can’t log in” is one sentence with several very different causes. The account’s state tells you which one you’re looking at, and reading it correctly is one of the most valuable L1 skills there is.
The four states
Section titled “The four states”- Active: signs in fine. If the user still can’t get in, the problem is somewhere else (a typo, a specific app, the network). The account itself is healthy.
- Locked: too many failed sign-in attempts tripped a temporary safety lock. Usually a quick unlock (or a short wait) fixes it. Worth a gentle check: why the bad attempts? A forgotten password, or a device hammering an old one?
- Disabled: someone deliberately switched the account off (a leaver, a security hold). Don’t just re-enable it: find out why it was disabled first.
- Expired: the account or its password has passed an end-date. Renew or reset it by policy.
Locked is not disabled
Section titled “Locked is not disabled”This is the distinction to lock in: a lock is a temporary trip the system applied, cleared by an unlock. Disabled is a deliberate switch a person flipped, and re-enabling blindly can undo exactly what they intended. Same “can’t log in” symptom, completely different response.