Oracle Error ORA-28000

Error code

ORA-28000

Product

Oracle Database

Versions

Oracle Database 19c, 21c, 23ai and 26ai (wording differs: see below)

Category

Logins, Accounts & Privileges

Last reviewed

24 October 2026

What it means

ORA-28000 means the account you are logging in with is locked, either automatically after too many failed logins, by an administrator, or (for a common user) in the root container, so Oracle refused the logon.

Oracle's reference lists three reasons: incorrect credentials were used for too many consecutive failed login attempts, an administrator locked the account, or the user is a common user locked in the root container. The ACCOUNT_STATUS column of DBA_USERS tells you which applies. LOCKED(TIMED) means the failed-login limit was reached and the account will unlock itself after PASSWORD_LOCK_TIME; LOCKED means it stays locked until someone unlocks it, either because an administrator locked it or because PASSWORD_LOCK_TIME is UNLIMITED.

The limits come from the user's profile. In CREATE PROFILE, FAILED_LOGIN_ATTEMPTS defaults to 10 and PASSWORD_LOCK_TIME to 1 day, and INACTIVE_ACCOUNT_TIME (default UNLIMITED) can lock accounts that have not logged in for a number of days. A user with no explicit profile gets the DEFAULT profile's limits.

Automatic locks are almost always the result of something retrying with a wrong password: an application or job after a password change, or someone guessing. Unlocking without finding that source just locks the account again, and if the attempts are hostile the lock is doing its job. That is why the lockout policy itself should stay in place.

Common causes

• An application, connection pool or scheduled job still uses an old password after a change, and its retries hit FAILED_LOGIN_ATTEMPTS.
• A person mistyped the password too many times (see ORA-01017 for why a correct-looking password can fail).
• An administrator locked the account deliberately with ALTER USER ... ACCOUNT LOCK, for example a sample or Oracle-supplied account that is locked by default.
• The account had not logged in for longer than the profile's INACTIVE_ACCOUNT_TIME.
• A common user (C##...) is locked in the root container, which Oracle lists as a separate cause: check the root as well as the PDB.
• Repeated attempts from an unknown host: someone trying to guess the password.

Diagnose it

Read-only These queries only read the data dictionary (USER_, ALL_ and DBA_ views) and dynamic performance views (V$). They do not change data, privileges or settings, so they are safe to run first. DBA_ and V$ views need the matching privileges.

SELECT username, account_status, lock_date, expiry_date, profile, common, oracle_maintained
FROM dba_users
WHERE username = 'APP_USER';

SELECT profile, resource_name, limit
FROM dba_profiles
WHERE profile = (SELECT profile FROM dba_users WHERE username = 'APP_USER')
  AND resource_name IN ('FAILED_LOGIN_ATTEMPTS', 'PASSWORD_LOCK_TIME', 'INACTIVE_ACCOUNT_TIME')
ORDER BY resource_name;

SELECT event_timestamp, os_username, userhost, client_program_name, return_code
FROM unified_audit_trail
WHERE dbusername = 'APP_USER'
  AND action_name = 'LOGON'
  AND return_code <> 0
  AND event_timestamp > SYSTIMESTAMP - INTERVAL '1' DAY
ORDER BY event_timestamp DESC;

How to fix it

Each fix is labelled with what it changes. Try read-only checks and the least invasive fix first, and test changes outside production.

ALTER USER app_user ACCOUNT UNLOCK;

-- unlock and set a new password together
ALTER USER app_user IDENTIFIED BY "New#Passw0rd-2026" ACCOUNT UNLOCK;

Examples

An application still using the old password after a change

Not reproduced here: no Oracle Database is installed for this site. The message text is from Oracle's error reference for current releases; Oracle Database 19c and 21c print "The account is locked.". The limit of 10 is the FAILED_LOGIN_ATTEMPTS default documented in CREATE PROFILE; your profile may differ.

-- the DBA changed the password
ALTER USER app_user IDENTIFIED BY "New#Passw0rd-2026";

-- the connection pool keeps retrying with the old one:
-- ORA-01017 ten times (FAILED_LOGIN_ATTEMPTS 10), then every logon gets:

ORA-28000: The account is locked; login denied.

A common user locked in the root container

Not reproduced here: no Oracle Database is installed for this site. The message format is from Oracle's error reference, which names a common user locked in the root container as one of the causes, without showing an example; this sequence is our illustration of that cause, and the user and service names are illustrative.

-- in CDB$ROOT, an administrator locked the common user
ALTER USER c##ops ACCOUNT LOCK;

-- later, connecting to a PDB
CONNECT c##ops@//dbhost:1521/SALESPDB

ERROR:
ORA-28000: The account is locked; login denied.

How to prevent it

Change service account passwords with a plan: update every client that stores the password at the same time, ideally from one wallet or secrets store, and watch failed logons (ORA-01017) right after the change. Give each application its own account so a lock affects only that application.

Keep failed-login lockout in every profile, review audited logon failures regularly, and lock accounts that are no longer used rather than leaving them open.

Common questions

Learn more on CodeWithSQL

• SQL security

Official documentation

• ORA-28000 (Oracle Database Error Messages)
• DBA_USERS (Oracle Database Reference 19c)
• CREATE PROFILE (Oracle SQL Language Reference 19c)
• ALTER USER (Oracle SQL Language Reference 19c)

Last technically reviewed 24 October 2026; examples and diagnostics run on Oracle Database Error Messages reference (26ai, 21c and 19c); not run locally. Messages and explanations follow Oracle's Database Error Messages reference; no Oracle Database was available, so the examples were not run locally.