Ipa User-unlock -

: If the user belongs to a trusted Active Directory (AD) domain, ipa user-unlock will not work. The account lockout must be cleared on the Windows Active Directory Domain Controller utilizing Active Directory Users and Computers (ADUC) or PowerShell's Unlock-ADAccount .

If your team finds themselves running ipa user-unlock too frequently, your global password policy might be too restrictive. You can modify these settings via the CLI or the Web UI. Viewing the Current Password Policy ipa pwpolicy-show Use code with caution. Modifying the Policy ipa user-unlock

: While ipa user-unlock specifically addresses failures related to password policies, the command ipa user-enable is used to reactivate accounts that were manually disabled by an administrator. : If the user belongs to a trusted

menu (typically located at the top right of the user details page) and select Proactive Management Tips 9.6. Unlocking User Accounts After Password Failures You can modify these settings via the CLI or the Web UI