Password reset and account unlock
Key Takeaway
One password reset fixes both a forgotten password and a lockout. Salesforce also resets the user's security token, except for API only users.
Users lose access to Salesforce when they forget their password or when they enter wrong login credentials too many times and get locked out. Admins can restore access by unlocking the account from the user record or by resetting the password. Users can also reset their own password with the forgot password link on the login page.
What locks a user out
A user is locked out after entering incorrect login credentials too many times. In Password Policies, the "Maximum invalid login attempts" setting sets how many failures are allowed before lockout. The "Lockout effective period" setting sets how long the lockout lasts, and the default lockout period is 15 minutes.
Some events besides a wrong password also count toward lockout. One is each time a user is prompted to verify identity. Another is each time a user logging in through the API or a client enters the security token or verification code incorrectly at the end of their password.
The Failed Login Attempts field on the user record shows how many failed logins the account has. Viewing this field requires the "Manage Users" permission.
The failed login counter resets in two cases, and the account ends up in a different state in each one.
If the user reaches the maximum number of invalid login attempts...
The counter resets and the account locks.
If the user logs in successfully before reaching that maximum...
The counter resets and the account stays unlocked.
A lockout does not end a session that is already open. If a user is logged in to an active session and is later locked out, the user stays logged in to that session.