The user’s Identity Manager account is locked. Note that this icon only reflects the locked state of the Identity Manager account, not any of the user’s resource accounts. 

Users become locked after exceeding the maximum number of failed Identity Manager account login attempts as defined in the Identity Manager Account Policy. Only failed password or question logins to Identity Manager accounts are counted towards the maximum allowed. Therefore, if an Identity Manager login application (that is, the administrator interface, the end-user interface, and so on) does not include the Identity Manager Login Module in its login module group, then the Identity Manager failed password policy will not be considered. However, regardless of the stack of login modules configured for a given Identity Manager login application, failed question logins that exceed the maximum configured in the Identity Manager Account Policy can cause a user to become locked and this icon to be displayed. 

For information on how to unlock accounts see Unlocking User Accounts.

The administrator Identity Manager account is locked. Note that this icon only reflects the locked state of the Identity Manager account, not any of the administrator’s resource accounts. For more information, see the description for the user lockout icon, above. 

The account is disabled on all assigned resources and on Identity Manager. (When an account is enabled, no icon appears.) 

For information about how to enable disabled accounts, see Disabling, Enabling, & Unlocking User Accounts.

The account is partially disabled, meaning that it is disabled on one or more assigned resources. 

The system attempted but failed to create or update the Identity Manager user account on one or more resources. (When an account is updated on all assigned resources, no icon appears.)