TechnitiumSoftware/DnsServer · error · DnsWebServiceException

User account is disabled. Please contact your administrator.

Error message

User account is disabled. Please contact your administrator.

What it means

Thrown as DnsWebServiceException when the user passed credential and (if applicable) TOTP validation but user.Disabled is true. The check runs after ResetFailedLoginAttempts, so a successful authentication of a disabled account still throws. Returned over the API as HTTP 200 with status 'error'.

Source

Thrown at DnsServerCore/Auth/AuthManager.cs:828

                Authenticator authenticator = new Authenticator(user.TOTPKeyUri);

                if (!authenticator.IsTOTPValid(totp))
                {
                    MarkFailedLoginAttempt(network);

                    if (HasLoginAttemptExceedLimit(network, MAX_LOGIN_ATTEMPTS))
                        BlockNetwork(network, BLOCK_NETWORK_INTERVAL);

                    await Task.Delay(1000);

                    throw new DnsWebServiceException("Invalid time-based one-time password (TOTP) was attempted for user: " + username);
                }
            }

            ResetFailedLoginAttempts(network);

            if (user.Disabled)
                throw new DnsWebServiceException("User account is disabled. Please contact your administrator.");

            return user;
        }

        private static IPAddress GetClientNetwork(IPAddress address)
        {
            switch (address.AddressFamily)
            {
                case AddressFamily.InterNetwork:
                    return address.GetNetworkAddress(32);

                case AddressFamily.InterNetworkV6:
                    return address.GetNetworkAddress(64);

                default:
                    throw new InvalidOperationException();
            }
        }

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Ask an administrator to re-enable the account (set user.Disabled = false) before retrying.
2. If you are the admin, enable the user via the Users management API/UI.
3. As a last resort, use resetadmin.config to reset and enable the built-in admin account.

// Before driving a login for a known account, surface a clear message if disabled
if (await IsUserDisabledAsync(username))
    return Result.Disabled();  // have an admin enable the account

try { await client.LoginAsync(user, pass, totp); }
catch (HttpApiClientException ex) when (ex.Message.Contains("User account is disabled"))
{
    ShowContactAdminMessage();
}

When it happens

Trigger: POST /api/user/login (or any session creation) for a user whose Disabled flag was set by an administrator. The account is intact and credentials are correct, but login is barred.

Common situations: An admin deactivated the account (e.g., departed employee, suspected compromise); the account was disabled via the UI/API and the user is still attempting to log in.

Related errors

• No such user exists: {username}
• Max limit of {MAX_LOGIN_ATTEMPTS} attempts exceeded. Access
• Invalid username or password for user: {username}
• Cannot create more than 255 users.
• User already exists: {username}

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/0e954395bf5c364a. Report an issue: GitHub.