Cannot login with domain credentials

Problem

You’re unable to log into your computer or company applications using your domain username and password.

Symptoms

• “Invalid username or password” error
• “Your account has been locked” message
• Unable to access company applications
• Computer won’t accept your password after a restart

Solutions

Verify your username format

Enter your credentials using the format that matches your account type:

• On‑premises Active Directory: DOMAIN\username (e.g., ACME\john.smith)
• Azure Entra ID / cloud‑only accounts: [email protected] (User Principal Name)

Tip: If you are unsure which format to use, contact the IT Service Desk.

Check keyboard settings

• Ensure Caps Lock is off at the Windows login screen before typing your password.
• Num Lock only affects entry from the numeric keypad; it does not change password validation.
• Try typing your password in a visible text field (e.g., Notepad) to confirm the characters you are entering.

Confirm multi‑factor authentication (MFA) status

If your organisation requires MFA/2FA, verify that the authentication app or hardware token is working correctly.

• Open the MFA app and ensure the time is synchronised.
• Resend the verification code if you did not receive one.
• Check that your contact details are up‑to‑date in the MFA security info portal.

Smart‑card, Windows Hello, or biometric login issues

• Make sure the smart‑card is inserted correctly and the reader is functional.
• For Windows Hello, confirm that the camera or fingerprint sensor is clean and recognised.
• Re‑enrol the biometric data if the device reports a failure.

Verify device domain‑join status

Ensure the computer is correctly joined to the domain:

• Open Settings → Accounts → Access work or school and confirm the domain name is displayed.
• Or go to Settings → System → About → Domain or workgroup and verify the domain membership.

Tip: If the device is not joined, contact IT for re‑joining assistance.

Domain trust issues and UPN suffix mismatches

If you receive an “Invalid username or password” error despite entering correct credentials, a domain trust issue or User Principal Name (UPN) suffix mismatch may be preventing authentication.

• Try logging in using the DOMAIN\username format instead of [email protected] to bypass UPN suffix resolution.
• If the computer was recently moved between domains or organisational units, a domain trust relationship may have failed.
• Contact IT to verify the domain trust status and confirm your UPN suffix matches the configured domain.

Network, VPN and DNS connectivity

• Ping a domain controller (e.g., ping dc01.company.com) to confirm network reachability.
• Run nslookup dc01.company.com to verify DNS resolution.
• If you are remote, ensure the VPN connection is active. See Connecting to company network remotely for guidance.

Isolate device vs account issue

Before proceeding, determine whether the problem is specific to your account or the device:

• Ask another user to attempt logging in to the same computer with their own domain credentials.
• If another user can log in, the issue is likely account‑specific. Proceed to account status and lockout steps.
• If no one can log in, the issue is likely device‑specific (domain‑join, network connectivity, or local hardware problem).

Account status and lockout

Accounts may be disabled, expired, or locked out due to policy violations. Most organisations enforce a lockout policy after a set number of failed sign‑in attempts (commonly 5 to 10 attempts), with a lockout duration of 15 to 30 minutes before automatic unlock.

• If you’ve entered the wrong password multiple times, wait for the lockout duration to expire before trying again.
• Contact the IT Service Desk to confirm the account’s status and request an unlock or re‑activation if required.
• Do not repeatedly attempt to log in while locked, as this may extend the lockout period.

Ensure date, time and time‑zone are correct

For guidance on keeping Windows up to date, see How to update Windows.

Check for cached credentials

Check for password expiry

If your password has expired, you will see a “Password expired” message at login. Follow the reset prompts and create a new password that meets the complexity requirements:

• At least 8 characters
• Mix of upper‑case, lower‑case, numbers and symbols
• Not a recent password

Reset your password

Choose the appropriate option:

• Option A – Use the password‑reset portal: Go to Password reset process and follow the prompts.
• Option B – If the portal is inaccessible: Try accessing it from a different device or network. If you still cannot reach the portal, Open a Ticket and request a password reset.

Safe Mode login when domain controllers are unreachable

If domain controllers are unreachable and you cannot log in with domain credentials, you may be able to sign in using a locally cached profile:

1. Restart the computer.
2. Hold down Shift while selecting Restart from the power menu to enter the Windows Recovery Environment.
3. Select Troubleshoot → Advanced options → Startup Settings → Restart.
4. Press the number key corresponding to Safe Mode or Safe Mode with Networking.
5. Attempt to log in with your domain username and password using cached credentials.

Note: Safe Mode login only works if you have previously logged on to this device successfully and your profile is cached locally.

Additional troubleshooting resources

• Cannot access shared network drives
• Cannot access SharePoint site

Preventing login issues

• Use a reputable password manager to store and retrieve your credentials securely.
• Enable multi‑factor authentication (MFA) where available.
• Keep your recovery options and contact information current in the MFA security info portal.
• Update your password before it expires.

Need more help?

If you still cannot log in, Open a Ticket. If the IT Service Desk is unreachable, use the ticket portal to escalate the issue and include your device name, username, and any error messages received.