<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="account-locking">
      </a>
      8.2.20 Account Locking
     </h3>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045247598176">
  </a>
  <p>
   MySQL supports locking and unlocking user accounts using the
   <code class="literal">
    ACCOUNT LOCK
   </code>
   and
   <code class="literal">
    ACCOUNT
      UNLOCK
   </code>
   clauses for the
   <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    <code class="literal">
     CREATE
      USER
    </code>
   </a>
   and
   <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
    <code class="literal">
     ALTER USER
    </code>
   </a>
   statements:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      When used with
      <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
       <code class="literal">
        CREATE USER
       </code>
      </a>
      ,
          these clauses specify the initial locking state for a new
          account. In the absence of either clause, the account is
          created in an unlocked state.
     </p>
     <p>
      If the
      <code class="literal">
       validate_password
      </code>
      component is
          enabled, creating an account without a password is not
          permitted, even if the account is locked. See
      <a class="xref" href="validate-password.html" title="8.4.3 The Password Validation Component">
       Section 8.4.3, “The Password Validation Component”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      When used with
      <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
       <code class="literal">
        ALTER USER
       </code>
      </a>
      ,
          these clauses specify the new locking state for an existing
          account. In the absence of either clause, the account locking
          state remains unchanged.
     </p>
     <p>
      <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
       <code class="literal">
        ALTER USER ...
          UNLOCK
       </code>
      </a>
      unlocks any account named by the statement
          that is temporarily locked due to too many failed logins. See
      <a class="xref" href="password-management.html" title="8.2.15 Password Management">
       Section 8.2.15, “Password Management”
      </a>
      .
     </p>
    </li>
   </ul>
  </div>
  <p>
   Account locking state is recorded in the
   <code class="literal">
    account_locked
   </code>
   column of the
   <code class="literal">
    mysql.user
   </code>
   system table. The output from
   <a class="link" href="show-create-user.html" title="15.7.7.13 SHOW CREATE USER Statement">
    <code class="literal">
     SHOW CREATE USER
    </code>
   </a>
   indicates whether
      an account is locked or unlocked.
  </p>
  <p>
   If a client attempts to connect to a locked account, the attempt
      fails. The server increments the
   <a class="link" href="server-status-variables.html#statvar_Locked_connects">
    <code class="literal">
     Locked_connects
    </code>
   </a>
   status variable
      that indicates the number of attempts to connect to a locked
      account, returns an
   <a class="ulink" href="/doc/mysql-errors/8.4/en/server-error-reference.html#error_er_account_has_been_locked" target="_top">
    <code class="literal">
     ER_ACCOUNT_HAS_BEEN_LOCKED
    </code>
   </a>
   error,
      and writes a message to the error log:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-none"><div class="docs-select-all right" id="sa57521029"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">Access denied for user '<em class="replaceable">user_name</em>'@'<em class="replaceable">host_name</em>'.
Account is locked.</code></pre>
  </div>
  <p>
   Locking an account does not affect being able to connect using a
      proxy user that assumes the identity of the locked account. It
      also does not affect the ability to execute stored programs or
      views that have a
   <code class="literal">
    DEFINER
   </code>
   attribute naming the
      locked account. That is, the ability to use a proxied account or
      stored programs or views is not affected by locking the account.
  </p>
  <p>
   The account-locking capability depends on the presence of the
   <code class="literal">
    account_locked
   </code>
   column in the
   <code class="literal">
    mysql.user
   </code>
   system table. For upgrades from
      MySQL versions older than 5.7.6, perform the MySQL upgrade
      procedure to ensure that this column exists. See
   <a class="xref" href="upgrading.html" title="Chapter 3 Upgrading MySQL">
    Chapter 3,
    <i>
     Upgrading MySQL
    </i>
   </a>
   . For nonupgraded installations that
      have no
   <code class="literal">
    account_locked
   </code>
   column, the server
      treats all accounts as unlocked, and using the
   <code class="literal">
    ACCOUNT
      LOCK
   </code>
   or
   <code class="literal">
    ACCOUNT UNLOCK
   </code>
   clauses
      produces an error.
  </p>
 </div>
 <br/>
</div>
