ORA-28000: The account is locked

What does it mean?

Logon fails because the database user account being connected to is locked.

Why does it happen?

The FAILED_LOGIN_ATTEMPTS limit in the profile was exceeded (repeated wrong passwords), or the account was locked manually by a DBA (ALTER USER ... ACCOUNT LOCK). A failed-login lock is released automatically after PASSWORD_LOCK_TIME. Note: PASSWORD_LIFE_TIME expiry does not lock the account; the account moves to EXPIRED / EXPIRED(GRACE) and returns ORA-28001/ORA-28002.

How to fix it

Check the account status: SELECT username, account_status, lock_date FROM dba_users WHERE username = 'APP_USER'. Unlock it: ALTER USER app_user ACCOUNT UNLOCK. To prevent recurrence, find the source of the failed logins and, if necessary, review FAILED_LOGIN_ATTEMPTS in the profile. If the password has expired, assign a new password.