ORA-28000: The Account Is Locked – Complete Oracle DBA Troubleshooting Guide

The ORA-28000: The account is locked error is one of the most common Oracle Database security and authentication errors encountered by Database Administrators (DBAs), application administrators, developers, and support engineers. The error indicates that Oracle has prevented a user account from authenticating because the account has been locked either automatically by the database security policy or manually by a database administrator.

Oracle Database includes a comprehensive password management framework that protects database accounts against unauthorized access and brute-force password attacks. When the number of consecutive failed login attempts exceeds the configured threshold defined in the user's password profile, Oracle automatically locks the account for the duration specified by PASSWORD_LOCK_TIME. Alternatively, administrators may intentionally lock accounts for maintenance, security, compliance, or operational reasons.

In production environments, ORA-28000 commonly affects application schemas, Oracle E-Business Suite users, middleware services, monitoring tools, scheduled jobs, Oracle Enterprise Manager (OEM), Oracle Data Guard environments, and Oracle Cloud Infrastructure (OCI) deployments. In many cases, unlocking the account alone is not sufficient because the application may continue using outdated credentials and immediately lock the account again.

Unlike ORA-28001 (Password Has Expired), which requires a password change, ORA-28000 indicates that authentication has been blocked because the account itself is locked. Understanding the distinction between password expiration and account locking is essential for resolving authentication problems efficiently while maintaining database security.

This complete Oracle DBA guide explains Oracle account locking architecture, password profile management, automatic and manual account locking, common causes, production troubleshooting, Oracle RAC, Oracle Data Guard, Oracle Multitenant (CDB/PDB), Oracle E-Business Suite, Oracle Cloud Infrastructure (OCI), real-world production scenarios, security best practices, and preventive measures for Oracle Database 11g, 12c, 18c, 19c, 21c, and Oracle Database 23ai.

Quick Solution

Verify the user's account status in DBA_USERS, determine whether the account was locked automatically or manually, identify the cause of repeated authentication failures, unlock the account if appropriate, update any applications using outdated credentials, and review the password profile configuration to prevent recurring lockouts.

Error Message

SQL*Plus Example

SQL> CONNECT hr/hrpassword

ERROR:
ORA-28000: The account is locked

Application Example

ORA-28000: The account is locked
ORA-01017: Invalid username/password; logon denied

Application servers, connection pools, JDBC clients, Oracle Enterprise Manager, Oracle Data Pump, RMAN, and middleware platforms may report ORA-28000 while repeatedly attempting to authenticate with a locked account.

What Does ORA-28000 Mean?

ORA-28000 indicates that Oracle Database has rejected the login request because the user account is currently locked. The account may have been locked automatically after exceeding the configured number of failed login attempts or manually by a database administrator.

Once an account is locked, Oracle denies all authentication attempts until one of the following occurs:

The account is manually unlocked.
The automatic lock period expires.
The database administrator changes the account status.

The exact recovery method depends on the password profile assigned to the user and the reason the account was locked.

Oracle Account Locking Architecture

Oracle manages account authentication through password profiles. Each database user is assigned a profile that controls password complexity, password lifetime, failed login attempts, account lock duration, password reuse, and other security parameters.

During authentication, Oracle performs several checks before granting access.

User Login

     │

     ▼

User Exists?

     │

     ▼

Account Locked?

     │

 ┌───┴────┐

 │        │

Yes       No

 │         │

 ▼         ▼

ORA-28000 Password Verification

               │

               ▼

Password Correct?

               │

        ┌──────┴──────┐

        │             │

       No            Yes

        │             │

Failed Login      Login Successful

Counter Updated

        │

Threshold Reached?

        │

        ▼

Account Locked

        │

        ▼

ORA-28000

Automatic vs. Manual Account Locking

Automatic Lock	Manual Lock
Occurs after exceeding FAILED_LOGIN_ATTEMPTS.	Performed using ALTER USER ACCOUNT LOCK.
Controlled by PASSWORD_LOCK_TIME.	Remains locked until manually unlocked.
Usually caused by incorrect passwords.	Used for maintenance or security purposes.
May automatically unlock after the lock period.	Requires DBA intervention.

ORA-28000 vs Related Authentication Errors

Error	Description	Primary Cause
ORA-28000	The account is locked.	Account status prevents login.
ORA-28001	Password has expired.	Password lifetime exceeded.
ORA-28002	Password will expire soon.	Password approaching expiration.
ORA-01017	Invalid username/password.	Authentication failure.

Common Causes of ORA-28000

1. Multiple Failed Login Attempts

The most common cause is repeated authentication failures exceeding the value defined by FAILED_LOGIN_ATTEMPTS in the user's profile.

2. Manual Administrative Lock

A DBA intentionally locks the account for maintenance, security investigations, employee termination, or compliance requirements.

3. Incorrect Application Credentials

Applications continue using an outdated password after the database password has been changed.

4. Scheduled Jobs

Batch jobs, shell scripts, cron jobs, or Windows Task Scheduler repeatedly attempt to authenticate using invalid credentials.

5. JDBC Connection Pools

Connection pools repeatedly retry failed authentication requests, quickly exhausting the allowed login attempts.

6. Oracle Enterprise Manager

OEM monitoring targets continue using expired or incorrect credentials.

7. Password Synchronization Issues

Password changes are not propagated consistently across clustered or replicated environments.

8. Brute-Force Login Attempts

Repeated unauthorized login attempts trigger Oracle's account locking mechanism to protect the database.

Common Symptoms

Users cannot log in to Oracle Database.
Applications suddenly stop connecting.
Connection pools continuously retry failed logins.
Oracle Enterprise Manager reports authentication failures.
Scheduled jobs begin failing.
RMAN or Data Pump authentication fails.
Application logs repeatedly show ORA-28000.
The account immediately locks again after being unlocked.

Production DBA Recommendation

Never unlock an Oracle account without first identifying why it became locked. If an application, connection pool, monitoring tool, or scheduled job continues using incorrect credentials, the account will lock again almost immediately. Always resolve the underlying authentication issue before unlocking the account.

Step-by-Step Oracle DBA Troubleshooting

When ORA-28000 occurs, the primary objective is to determine why the account was locked before simply unlocking it. In production environments, repeatedly unlocking an account without correcting the underlying authentication problem usually results in the account being locked again within seconds or minutes.

Step 1 – Verify the Account Status

Begin by checking the current status of the user account.

SELECT

USERNAME,

ACCOUNT_STATUS,

LOCK_DATE,

EXPIRY_DATE,

PROFILE

FROM DBA_USERS

WHERE USERNAME = UPPER('<USERNAME>');

Example output:

USERNAME       ACCOUNT_STATUS

-------------- ----------------------

HR             LOCKED(TIMED)

Common account statuses include:

OPEN – Account is available.
LOCKED – Manually locked.
LOCKED(TIMED) – Automatically locked after failed login attempts.
EXPIRED – Password has expired.
EXPIRED & LOCKED – Password expired and account locked.

Step 2 – Identify the User Profile

Determine which password profile governs the account.

SELECT

USERNAME,

PROFILE

FROM DBA_USERS

WHERE USERNAME = UPPER('<USERNAME>');

Step 3 – Review Password Profile Settings

Check the security parameters defined for the assigned profile.

SELECT

RESOURCE_NAME,

LIMIT

FROM DBA_PROFILES

WHERE PROFILE='DEFAULT'

ORDER BY RESOURCE_NAME;

Pay particular attention to:

FAILED_LOGIN_ATTEMPTS
PASSWORD_LOCK_TIME
PASSWORD_LIFE_TIME
PASSWORD_GRACE_TIME
PASSWORD_REUSE_TIME

Step 4 – Unlock the Account

If the account was intentionally or automatically locked and it is safe to restore access, unlock it.

ALTER USER hr ACCOUNT UNLOCK;

If the password must also be reset:

ALTER USER hr

IDENTIFIED BY NewStrongPassword

ACCOUNT UNLOCK;

Step 5 – Investigate Failed Login Attempts

Do not assume the user entered an incorrect password manually. Determine what is generating the authentication failures.

Common sources include:

Application servers
Connection pools
JDBC applications
WebLogic
Oracle E-Business Suite
Oracle Enterprise Manager
Scheduled jobs
Custom scripts
Third-party monitoring software

Step 6 – Review Unified Auditing (If Enabled)

Audit records often identify the source of repeated failed authentication attempts.

SELECT

DBUSERNAME,

USERHOST,

EVENT_TIMESTAMP,

ACTION_NAME,

RETURN_CODE

FROM UNIFIED_AUDIT_TRAIL

WHERE RETURN_CODE = 28000

ORDER BY EVENT_TIMESTAMP DESC;

Step 7 – Review the Listener Log

The Oracle Listener log frequently shows the client host responsible for repeated login failures.

Typical Linux location:

$ORACLE_BASE/diag/tnslsnr/

hostname/listener/trace/listener.log

Step 8 – Verify Application Credentials

If the account belongs to an application schema, confirm that every application server has been updated with the latest password.

Common examples include:

JDBC Data Sources
Oracle WebLogic
Apache Tomcat
Oracle Forms
Oracle Reports
Oracle REST Data Services (ORDS)
Spring Boot applications
Microservices

Step 9 – Check Scheduled Jobs

Review all scheduled tasks that connect to Oracle.

Typical examples:

cron jobs
Windows Task Scheduler
RMAN backup scripts
Shell scripts
PowerShell scripts
Python automation

Step 10 – Review Brute-Force Activity

Repeated authentication failures from unknown hosts may indicate a password guessing or brute-force attack.

Review:

Firewall logs
VPN logs
Oracle Listener log
SIEM alerts
Unified Audit Trail

Step 11 – Oracle RAC Considerations

In Oracle RAC environments:

Verify all nodes use identical passwords.
Review services configured with application schemas.
Check connection pools across every node.
Ensure authentication failures are not isolated to a single node.

Step 12 – Oracle Data Guard Considerations

If application services fail over to the standby database, ensure passwords remain synchronized between primary and standby systems where applicable.

Verify the current database role.

SELECT DATABASE_ROLE

FROM V$DATABASE;

Step 13 – Oracle Multitenant (CDB/PDB) Considerations

Determine whether the account is a common user or a local PDB user.

SHOW CON_NAME;

Unlock the account in the correct container.

Step 14 – Oracle E-Business Suite Considerations

For Oracle E-Business Suite environments:

Verify APPS credentials.
Review Concurrent Manager.
Check WebLogic managed servers.
Review AutoConfig updates.
Restart affected services if credentials have changed.

Step 15 – Oracle Cloud Infrastructure (OCI) Considerations

For OCI virtual machines:

Review application credentials.
Check OCI monitoring services.
Review audit logs.
Verify IAM integrations if applicable.

Real Production Case Study

A financial application suddenly became unavailable after a scheduled password rotation. The DBA unlocked the application schema successfully, but the account locked again within two minutes.

Investigation showed that one of four WebLogic managed servers still contained the old database password in its JDBC data source configuration. That server continuously attempted to establish new database connections using outdated credentials, quickly exceeding the configured FAILED_LOGIN_ATTEMPTS limit.

After updating the JDBC password on all managed servers and restarting the connection pools, the account remained unlocked and normal application operation resumed.

Oracle DBA Troubleshooting Checklist

Verification	Status
Account Status Verified	☐
User Profile Identified	☐
Password Profile Reviewed	☐
Account Unlocked (If Appropriate)	☐
Password Reset (If Required)	☐
Application Credentials Verified	☐
Scheduled Jobs Reviewed	☐
Unified Audit Reviewed	☐
Listener Log Reviewed	☐
RAC / Data Guard / OCI Reviewed (If Applicable)	☐
Authentication Successfully Retested	☐

Oracle Version Considerations

Oracle account locking behavior has remained fundamentally consistent across Oracle Database releases. However, newer versions introduce stronger password policies, enhanced auditing, Multitenant architecture, and tighter integration with Oracle Cloud Infrastructure (OCI). Understanding version-specific behavior helps DBAs troubleshoot authentication issues more efficiently.

Oracle Version	ORA-28000 Considerations
Oracle 10g	Basic password profile management and account locking features.
Oracle 11g	Enhanced password verification functions and Automatic Diagnostic Repository (ADR).
Oracle 12c	Multitenant (CDB/PDB), common and local users, Unified Auditing support.
Oracle 18c / 19c	Improved password management, stronger default security settings, and enhanced auditing.
Oracle 21c / 23ai	Advanced security features, OCI integration, and improved identity management.

Oracle Password Security Best Practices

Assign appropriate password profiles to all database users.
Configure FAILED_LOGIN_ATTEMPTS according to your organization's security policy.
Set a reasonable PASSWORD_LOCK_TIME to balance security and operational availability.
Use strong passwords that comply with your password verification function.
Rotate application passwords through a controlled change process.
Update all application servers immediately after changing database passwords.
Review locked accounts regularly and investigate repeated lockouts.
Enable Unified Auditing for authentication events whenever possible.
Restrict administrative privileges using the Principle of Least Privilege.
Document all manual account locks and unlocks for audit purposes.

Common Administrator Mistakes

Unlocking an account without determining why it was locked.
Changing the database password but forgetting to update application configuration files.
Ignoring scheduled jobs that still use old credentials.
Setting FAILED_LOGIN_ATTEMPTS excessively high or to UNLIMITED, reducing protection against brute-force attacks.
Disabling password verification functions without a security review.
Unlocking accounts repeatedly instead of fixing the root cause.
Failing to monitor Oracle audit records after repeated authentication failures.
Leaving unused database accounts enabled.
Using shared application accounts without proper credential management.
Ignoring repeated ORA-28000 errors in application logs.

Useful SQL Queries

Check Account Status

SELECT

USERNAME,

ACCOUNT_STATUS,

LOCK_DATE,

EXPIRY_DATE,

PROFILE

FROM DBA_USERS

ORDER BY USERNAME;

Review Password Profile

SELECT

PROFILE,

RESOURCE_NAME,

LIMIT

FROM DBA_PROFILES

WHERE RESOURCE_TYPE='PASSWORD'

ORDER BY PROFILE, RESOURCE_NAME;

Display Locked Accounts

SELECT

USERNAME,

ACCOUNT_STATUS,

LOCK_DATE

FROM DBA_USERS

WHERE ACCOUNT_STATUS LIKE 'LOCKED%';

Unlock an Account

ALTER USER hr ACCOUNT UNLOCK;

Unlock and Reset Password

ALTER USER hr

IDENTIFIED BY NewStrongPassword

ACCOUNT UNLOCK;

Useful Linux Commands

Command	Purpose
`tail -100 listener.log`	Review recent Oracle Net authentication activity.
`grep ORA-28000 listener.log`	Search listener log for account lock events.
`grep ORA-01017 listener.log`	Identify repeated authentication failures.
`ps -ef \| grep java`	Identify running Java application servers.
`systemctl status`	Verify application service status.
`crontab -l`	Review scheduled jobs.
`journalctl -xe`	Review recent Linux system events.
`find / -name "*.properties"`	Locate application configuration files containing database credentials.
`grep -Ri "jdbc" /opt`	Locate JDBC configuration files.
`netstat -an \| grep 1521`	Review active Oracle Net connections.

Oracle Account Lock Troubleshooting Flowchart

User Login Attempt

        │

        ▼

ORA-28000 Returned

        │

        ▼

Check DBA_USERS

        │

        ▼

LOCKED or LOCKED(TIMED)?

        │

   ┌────┴────┐

   │         │

 Manual   Automatic

 Lock       Lock

   │          │

   ▼          ▼

Unlock   Review FAILED_LOGIN_ATTEMPTS

Account   and PASSWORD_LOCK_TIME

        │

        ▼

Review Application Credentials

        │

        ▼

Review Scheduled Jobs

        │

        ▼

Review Audit Trail

        │

        ▼

Retest Login

        │

        ▼

Resolved

Frequently Asked Questions (FAQ)

Why does ORA-28000 occur?

ORA-28000 occurs when Oracle rejects a login because the account is locked. The lock may be automatic after repeated failed login attempts or manual through an administrative action.

How do I unlock an Oracle account?

ALTER USER username ACCOUNT UNLOCK;

If the password has also expired, reset the password and unlock the account in the same command.

Why does the account lock again immediately?

This usually indicates that an application, connection pool, monitoring tool, or scheduled job is still attempting to connect with outdated credentials.

Can Oracle automatically unlock the account?

Yes. If the account status is LOCKED(TIMED), Oracle automatically unlocks it after the period defined by PASSWORD_LOCK_TIME. Accounts locked manually remain locked until a DBA issues ALTER USER ... ACCOUNT UNLOCK.

Should I set FAILED_LOGIN_ATTEMPTS to UNLIMITED?

Generally, no. Unlimited failed login attempts significantly weaken database security and increase exposure to password guessing attacks. Choose a value that balances operational needs with security requirements.

About the Author

Rana Abdul Wahid is an Oracle Database Consultant with over 15 years of experience in Oracle Database Administration, Oracle RAC, Oracle Data Guard, RMAN Backup & Recovery, Oracle E-Business Suite, Oracle Cloud Infrastructure (OCI), Oracle Performance Tuning, Linux/Unix Administration, MySQL, Microsoft SQL Server, PostgreSQL, and enterprise database management.

He shares production-tested Oracle troubleshooting solutions, security best practices, performance tuning techniques, backup and recovery procedures, and real-world DBA experience gained from managing mission-critical Oracle environments.

Learn more about the author →

Conclusion

ORA-28000: The Account Is Locked is a security feature designed to protect Oracle Database from unauthorized access and repeated authentication failures. Although unlocking the account may restore access temporarily, long-term resolution requires identifying and eliminating the underlying cause of the lockout.

By systematically reviewing account status, password profiles, failed login attempts, application credentials, scheduled jobs, audit records, and Oracle infrastructure components such as RAC, Data Guard, Multitenant databases, and OCI deployments, DBAs can resolve ORA-28000 quickly while maintaining a secure database environment.

Implementing strong password policies, monitoring authentication failures, auditing account activity, and maintaining consistent credential management across all applications are essential practices for preventing future account lockouts and ensuring reliable Oracle Database security.

Final DBA Recommendation

Never treat ORA-28000 as simply an account unlock task. Every account lock should be investigated to determine its root cause. Resolving the underlying authentication issue before unlocking the account prevents recurring outages, improves security, and helps protect Oracle Database against unauthorized access.

Found this guide helpful? Visit our Oracle Error Codes Guide for more production-tested Oracle DBA troubleshooting articles, Oracle security best practices, Oracle RAC solutions, backup and recovery procedures, performance tuning techniques, and Oracle Cloud Infrastructure administration guides.

Oracle Database Error Solutions & DBA Knowledge Base