: Navigate to the Users tab, select the locked user, and use the Actions menu to select Unlock .
ipa user-unlock does change the password. It simply removes the nsaccountlock attribute from the user's LDAP entry and resets the failed login counter in the Kerberos KDC.