Unable to unlock accounts (4226924)

Unable to unlock accounts in Password Manager.

If the Password Manager service account is using minimum permissions as outlined in the following solution KB 27946 there has been occasion where an additional permission is needed to unlock accounts.

The permission steps below may be required to unlock an account and can be applied to a user or a group. Please apply the permissions below to the service account being used with Password Manager.

1. Determine the group or user account that you want to have the right to unlock user accounts in Active Directory Users and Computers
2. Right-click the domain in Active Directory Users and Computers, and then click Delegate Control from the menu that is displayed
3. The Delegation of Control Wizard should be displayed. On the Welcome dialog box, click Next.
4. On the Users and Groups dialog box, click Add. Select the group in the list that you want to give the right to unlock accounts, and then click OK. On the Users and Groups dialog box, click Next.
5. On the Tasks to Delegate dialog box, click Create a custom task to delegate, and then click Next.
6. On the Active Directory Object Type dialog box, click Only the following objects in the folder:. In the list, click User objects (the last entry in the list), and then click Next.
7. On the Permissions dialog box, click to clear the General check box, and then click to select the Property-specific check box. In the Permissions list, select Read lockoutTime check box, Write lockoutTime and then click Next.
8. On the Completing the Delegation of Control Wizard dialog box, click Finish