ORA-28000: the account is locked

ORA-28000: The account is locked.

The account was locked, usually after too many failed logins (FAILED_LOGIN_ATTEMPTS in the profile), or by an administrator. A DBA can unlock it, but find out what keeps sending the wrong password first, or it will lock again.

What ORA-28000 means

Each user has a profile, and the FAILED_LOGIN_ATTEMPTS limit locks the account after that many wrong passwords. The usual reason for repeated locking is an old password saved somewhere: an application server, a scheduled job or a tool that tries it over and over.

Common causes of ORA-28000

• Too many failed logins in a row.
• An application, job or connection pool still using an old password after a password change.
• An administrator locking the account on purpose.
• An expired password followed by repeated attempts.

How to fix ORA-28000

1. Check the status: ACCOUNT_STATUS and LOCK_DATE in DBA_USERS.
2. Find who is failing, through the audit trail or the listener log.
3. Update the password in every place it is stored.
4. Then unlock the account: ALTER USER app_user ACCOUNT UNLOCK.

ORA-28000 example

Why and when was it locked?

SELECT username, account_status, lock_date, profile
  FROM dba_users
 WHERE username = 'APP_USER';

SELECT resource_name, limit
  FROM dba_profiles
 WHERE profile = 'DEFAULT'
   AND resource_name IN ('FAILED_LOGIN_ATTEMPTS', 'PASSWORD_LOCK_TIME');

Unlock it:

ALTER USER app_user ACCOUNT UNLOCK;

In SQLlightspeed

When a statement fails, SQLlightspeed’s error panel shows the error code with a plain-language explanation and a suggestion for what to do next, together with Oracle’s own message and a link to Oracle’s documentation — for this error and dozens of other common ones.

Related errors

ORA-28001ORA-01017ORA-01031 All Oracle errors →

Oracle documentation for ORA-28000. Oracle is a registered trademark of Oracle Corporation. SQLlightspeed is not affiliated with Oracle.