Hi @akemi,
This can happen on Windows devices using local accounts.
The message “The referenced account is currently locked out and may not be logged on to” usually appears when Windows detects multiple failed sign-in attempts while the device is locked. Since this is a local Windows account, the lockout may clear automatically after the configured cooldown period, which is why the user could sign in again later.
On Lenovo ThinkPad models with fingerprint, IR camera, or presence-sensing features, background authentication attempts can sometimes contribute to this behavior. For example, Windows Hello facial recognition, fingerprint authentication, or Lenovo Presence Sensing/Smart Assist may repeatedly attempt sign-in when movement is detected near the device.
Recommended checks:
- Open Settings > Accounts > Sign-in options and temporarily disable Windows Hello face or fingerprint sign-in.
- Open Lenovo Vantage, go to Smart Assist, and temporarily disable features such as Zero Touch Lock or Presence Sensing.
- Open Credential Manager > Windows Credentials and remove stale or expired credentials that are no longer required.
- Ask the user to manually lock the screen with Windows + L before stepping away.
Hexnode Action History may not show anything in this case because the lockout is caused by local Windows authentication attempts, not by a Hexnode remote action or policy execution.
Regards,
Sienna Carter
Hexnode UEM