Check the global password policy ( ipa pwpolicy-show ) to see if the threshold for lockouts is too restrictive.
: Before unlocking, you can check if an account is locked using ipa user-status . ipa user-unlock
In enterprise Linux environments using FreeIPA (Identity, Policy, Audit) for centralized identity management, account security is paramount. A common security measure is the automatic locking of user accounts after multiple failed password attempts. While this protects against brute-force attacks, it often leads to legitimate users being locked out. Check the global password policy ( ipa pwpolicy-show