Unlock a Password Credential

The assistant can use password authentication again, and you want to remove the earlier password lock. usermod -U reverses that lock when the operation is valid for the current record. It does not reset every possible reason an account might be unable to log in.

For example, an account-expiration rule or an unsuitable login shell is separate from the password's lock marker. We will inspect the credential status and resist the temptation to interpret one successful command as proof that every access requirement is satisfied.

What you’ll learn

Remove a password lock when appropriate.
Check separate expiration and login restrictions before assuming access is restored.

A lock and an expiry rule are separate gates

1
Locked credential
Password authentication is restricted by its lock marker.
```
locked password
```
→2
Unlock
usermod -U removes that password lock when possible.
```
credential unlocked
```
→3
Other rules
Account expiry or policy restrictions can still prevent access.
```
check remaining restrictions
```

Reverse the specific lock you intended, inspect its result, and check the remaining login conditions independently.

Remove a password lock and inspect the status

Prepare the example

Use the disposable account previously locked in the VM. Check its state and ensure a suitable password credential exists; do not try to create passwordless access as a shortcut. An authorized administrator should perform the operation and read any diagnostic it returns.

Bash · Linux terminal

sudo usermod -U school-assistant
sudo passwd -S school-assistant

Expected behavior; machine-dependent details

The password status is updated when unlocking is permitted.

usermod -U school-assistant requests removal of the password lock. passwd -S school-assistant then helps inspect the credential's reported state. The utility can reject an invalid or unsafe transition, so the actual result matters more than simply reaching the next line.

If authentication still fails, inspect aging, account expiration, shell settings and the relevant login policy. Unlocking does not erase those fields. Diagnose the specific remaining condition before broadening access; otherwise you can remove a restriction that was intentional while leaving the actual problem unexplained.

Remove the lock and check remaining restrictions

Unlocking restores a password entry that was previously locked. It is useful when a suspended account is ready to be used again without recreating the user.

Step 1: Check If a User Account Is Locked

Let’s say the username is john. To check if the account is locked, we’ll use the passwd -S command:

sudo passwd -S john

john L 06/30/2025 0 99999 7 -1

The letter L in the second column means the account is Locked. If you see a P, it means the account is Active (Password set).

Step 2: Unlock the User Account

To unlock the user account, just run the following command:

sudo passwd -u john

passwd: password expiry information changed.

Optional: Verify Unlock Status

You can recheck the status to make sure the account is now unlocked:

sudo passwd -S john

john P 06/30/2025 0 99999 7 -1

Notice the P now? That means the account is active again!

Bonus: What If It’s a Locked Shell?

Sometimes, accounts are locked by assigning /sbin/nologin or /bin/false as their login shell. To fix that, you can change the shell like this:

sudo usermod -s /bin/bash john

This ensures the user has access to a valid shell.

That’s a Wrap!

And that’s how you unlock a user account in Linux! Whether you’re managing your own machine or helping a colleague, you now know exactly what to do when a user gets locked out.

Want to keep learning?

Try it, then check the worked answer

Your task: Does -U also reverse every expiration rule?

Use the disposable account previously locked in the VM. Check its state and ensure a suitable password credential exists; do not try to create passwordless access as a shortcut. An authorized administrator should perform the operation and read any diagnostic it returns.

Bash · complete example for this question

sudo usermod -U school-assistant
sudo passwd -S school-assistant

Expected behavior; machine-dependent details

The password status is updated when unlocking is permitted.

Worked answer

No; expiration settings are separate.

Unlocking does not reverse every expiration rule. It targets the password lock mechanism. If access remains restricted, read the account and authentication settings instead of assuming the password operation failed merely because another rule still applies.

Unlocking does not reverse every restriction

Reverse the specific lock you intended, inspect its result, and check the remaining login conditions independently. A credential state is one part of account access. Keep administrative recovery available while practicing these transitions in a disposable VM.

Reaching the recap and completing the quizzes are separate milestones.

Next lesson: Choose a Login Shell →

Unlock a Password Credential