Your account has been disabled message after exiting Audit Mode

In today’s post, we will identify the cause and then provide the solution/workaround to the error message Your account has been disabled that you might encounter after you turn off a Windows 11/10-based computer from Audit Mode.

When Windows boots, it starts in either Out-Of-Box Experience (OOBE) mode or in audit mode. OOBE is the default out-of-box experience that allows end-users to enter their account information, select language, accept the Microsoft Terms of Service, and set up networking.

You can configure Windows to boot to Audit Mode instead. In the audit mode, you can make additional changes to the Windows installation before you send the computer to a customer or capture the image for reuse in your organization. For example, you can install drivers included in a driver package, install applications, or make other updates that require the Windows installation to be running. When you use an answer file, Windows processes settings in the auditSystem and auditUser configuration passes.

When you boot to audit mode, log into the system using the built-in administrator account. After you log on to the system, the built-in administrator account is immediately disabled during the auditUser configuration pass. The next time the computer reboots, the built-in administrator account remains disabled.

Your account has been disabled message after exiting Audit mode

Let’s look at a typical scenario that can trigger this error message.

You’re working on a Windows computer and you go into Sysprep Audit Mode from the Out of Box Experience (OOBE) screen. Next, you turn off the computer by using the Shut down command on the Start menu, or you use one of the following Shut down options:

Log off
Sleep
Hibernate.

Then, you restart or wake the computer. You’ll receive the following error message on the logon screen:

Your account has been disabled, Please see your system administrator.

According to Microsoft, this is expected behavior because the system is using Hybrid Shutdown (also known as Fast Startup) during Audit mode.

In Audit mode, the administrator account is enabled immediately before logoff and disabled immediately after logon. Therefore, the account is locked out when you turn off the computer and then turn it back on.

To work around this behavior, disable Hybrid Shutdown. To do this, follow these steps:

Launch Command Prompt in elevated mode.

At the command prompt, type or copy and paste the following command, and then hit Enter: