Device lockout is an event that prevents an endpoint from being used normally. The device may refuse sign-in, block access to files or apps, or enter a restricted state until an administrator restores access. Lockouts can be caused by security tools, policy enforcement, failed authentication, or malicious actions that deliberately disrupt operations.
In cyber security, device lockout matters because it can stop work across many systems at once, especially when the affected devices belong to a managed fleet. Attackers may trigger lockouts through abused admin privileges, ransomware-like behavior, or tampering with device management systems. Defenders reduce the risk with strong access control, separation of duties, multi-factor authentication, rapid account revocation, endpoint monitoring, and recovery procedures for restoring trusted devices quickly.