Unblocking an Account
Clearing a ban restores access immediately. The question is whether that is the right response.
Where to find it
Architect Panel → Security:
- Blocked User Accounts — where a ban is cleared
- Disabled User Accounts — where a disabled account is re-enabled instead
Architect Panel → Configuration:
- Site Settings — usually the better answer
Verify who you are talking to first
An unblock request is an access request, and it arrives by telephone or e-mail from somebody claiming to be the account holder. That is precisely the shape of a social engineering attempt — the attacker triggers the lock-out themselves, then calls to have it cleared.
Use whatever identity check you would use before a password reset. If you do not have one, that gap matters more than anything else in this article.
Ask why they failed
Before clearing anything:
- Forgot the password — reset it. Unblocking alone means they will fail again and re-ban within minutes.
- Password recently changed — something else is probably still using the old one.
- They were not trying — somebody else was. That is an incident, not a lock-out.
The third answer changes what you do entirely, and you only get it by asking.
Usually reset rather than unblock
The commonest cause is a forgotten password, and the ban is a symptom. Resetting fixes the cause and the ban lapses on its own.
Check whether it is a ban at all
If the account is disabled rather than blocked, unblocking does nothing. Re-enabling a disabled account is a separate, more considered decision — the reason it was disabled is recorded, and it should be read before reversing it.
Look for a stale credential
An account banning itself repeatedly, especially overnight, is almost always something automated still using an old password — a mail client, a mobile app, a script, an integration. The user is often unaware.
Clearing the ban fixes nothing here; the retry loop re-bans within minutes. Find the client.
Repeated unblocking is a signal
If the same account needs clearing regularly, stop clearing and investigate. Recurring manual intervention almost always means a stale credential, a shared account, or somebody being targeted — and each has a real fix.
Note what you did
Who asked, how you verified them, what you found and what you did. This is the record that matters if the request turns out not to have been genuine, and it takes a sentence.
Worked example
An account bans itself every twenty minutes overnight. The helpdesk clears it three times before anybody asks why. The user changed their password a week earlier and a tablet mail client still holds the old one, retrying continuously. Signing the tablet in properly ends it — after three unblocks that each lasted twenty minutes.
Recommendations
- Verify identity as rigorously as for a password reset.
- Ask why they failed before clearing anything.
- Reset the password rather than just unblocking.
- Investigate the third repeat instead of clearing it again.