{"record":{"id":"0e954395bf5c364a","repo":"TechnitiumSoftware/DnsServer","slug":"user-account-is-disabled-please-contact-your-admi","errorCode":null,"errorMessage":"User account is disabled. Please contact your administrator.","messagePattern":"User account is disabled\\. Please contact your administrator\\.","errorType":"exception","errorClass":"DnsWebServiceException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Auth/AuthManager.cs","lineNumber":828,"sourceCode":"                Authenticator authenticator = new Authenticator(user.TOTPKeyUri);\n\n                if (!authenticator.IsTOTPValid(totp))\n                {\n                    MarkFailedLoginAttempt(network);\n\n                    if (HasLoginAttemptExceedLimit(network, MAX_LOGIN_ATTEMPTS))\n                        BlockNetwork(network, BLOCK_NETWORK_INTERVAL);\n\n                    await Task.Delay(1000);\n\n                    throw new DnsWebServiceException(\"Invalid time-based one-time password (TOTP) was attempted for user: \" + username);\n                }\n            }\n\n            ResetFailedLoginAttempts(network);\n\n            if (user.Disabled)\n                throw new DnsWebServiceException(\"User account is disabled. Please contact your administrator.\");\n\n            return user;\n        }\n\n        private static IPAddress GetClientNetwork(IPAddress address)\n        {\n            switch (address.AddressFamily)\n            {\n                case AddressFamily.InterNetwork:\n                    return address.GetNetworkAddress(32);\n\n                case AddressFamily.InterNetworkV6:\n                    return address.GetNetworkAddress(64);\n\n                default:\n                    throw new InvalidOperationException();\n            }\n        }","sourceCodeStart":810,"sourceCodeEnd":846,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/AuthManager.cs#L810-L846","documentation":"Thrown as DnsWebServiceException when the user passed credential and (if applicable) TOTP validation but user.Disabled is true. The check runs after ResetFailedLoginAttempts, so a successful authentication of a disabled account still throws. Returned over the API as HTTP 200 with status 'error'.","triggerScenarios":"POST /api/user/login (or any session creation) for a user whose Disabled flag was set by an administrator. The account is intact and credentials are correct, but login is barred.","commonSituations":"An admin deactivated the account (e.g., departed employee, suspected compromise); the account was disabled via the UI/API and the user is still attempting to log in.","solutions":["Ask an administrator to re-enable the account (set user.Disabled = false) before retrying.","If you are the admin, enable the user via the Users management API/UI.","As a last resort, use resetadmin.config to reset and enable the built-in admin account."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before driving a login for a known account, surface a clear message if disabled\nif (await IsUserDisabledAsync(username))\n    return Result.Disabled();  // have an admin enable the account","typeGuard":null,"tryCatchPattern":"try { await client.LoginAsync(user, pass, totp); }\ncatch (HttpApiClientException ex) when (ex.Message.Contains(\"User account is disabled\"))\n{\n    ShowContactAdminMessage();\n}","preventionTips":["Re-enable disabled accounts via admin tooling before users retry.","Communicate account deactivations to affected users."],"tags":["auth","login","user-management","disabled"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}