How to fix Error 1331 on Windows 11

by

Why This Error Happens

Error 1331 occurs when a local or domain user account has been administratively disabled in the Security Account Manager (SAM) database or Active Directory. This typically happens due to security policies triggering automatic lockouts, manual deactivation by an IT administrator, or corruption in the user profile’s account control flags (UserAccountControl attribute). Windows 11 blocks the sign-in process entirely at the authentication level before credentials are even validated.

Step-by-Step Resolution Guide

Step 1: Verify Account Status via Command Prompt

  • Open Command Prompt as Administrator (right-click Start > Terminal (Admin)).
  • Run the command: net user [username] to check the “Account active” status field.
  • If it shows “No,” the account is confirmed disabled at the system level.

Step 2: Re-enable the Account Using Local Users and Groups

  • Press Win + R, type lusrmgr.msc, and hit Enter.
  • Navigate to Users folder in the left pane.
  • Right-click the affected username, select Properties.
  • Uncheck the box labeled “Account is disabled” under the General tab and click Apply.

Step 3: Re-enable via Command Line (Alternative Method)

  • If the GUI is inaccessible, use elevated Command Prompt.
  • Run: net user [username] /active:yes
  • Press Enter and wait for the “The command completed successfully” confirmation message.

Step 4: Check Group Policy for Automated Lockout Rules

  • Open gpedit.msc (Local Group Policy Editor).
  • Go to Computer Configuration > Windows Settings > Security Settings > Account Policies > Account Lockout Policy.
  • Review “Account lockout duration” and “Account lockout threshold” to ensure a script or policy isn’t re-disabling the account immediately after activation.

Step 5: Restart the Netlogon Service (For Domain-Joined Devices)

  • Open Services (services.msc).
  • Locate Netlogon in the list, right-click, and select Restart.
  • This clears cached authentication tickets that might be enforcing the old “disabled” status.

Alternative or Verification Steps

  • Verification: Log off completely and attempt to sign in again. Alternatively, run net user [username] in CMD again to confirm “Account active” now reads Yes.
  • Alternative Fix: If the account remains disabled after these steps, boot into Safe Mode (Shift + Restart > Troubleshoot > Advanced Options) and repeat Step 2, as third-party antivirus software sometimes locks SAM database edits during normal boot sessions.