Oracle Database / Accounts, Security & Access
ORA-28000: find the source of account lockouts before unlocking
An application account can immediately relock if an old credential remains in a job or pool. Inspect account state and the assigned profile.
Environment and inputs: Oracle Database 19c baseline · SQL*Plus-compatible SQL unless RMAN, DGMGRL, ADRCI or a host shell is specified. Check release, patch level, edition and container first.
Start with this diagnostic
Use the stated SQL, RMAN, DGMGRL or host shell and replace sample names with approved targets. DBA and V$ views need authorized catalog access in the correct container. Do not grant broad privileges for an example.
SELECT username, account_status, lock_date, profile FROM dba_users WHERE username = 'APP_USER';Read the result
The status distinguishes lock-related states, while the profile determines relevant password rules. Current state alone does not identify the retrying client.
Resolve and verify
Correlate authorized authentication records with application replicas and scheduled jobs. Correct the obsolete secret source before the DBA performs an approved unlock.
Operational precautions
Do not repeatedly unlock an account while uncontrolled bad-password retries continue.