• Clarice:

    "Disabled" indicates the account has been turned off, either by an administrator or perhaps by the system due to inactivity. "Locked" usually means the user had too many failed logins and the account is locked to prevent unauthorized access.

    Looking at the logs should give a clue as to why users are being locked out: bad PIN but good tokencode, passcode reuse, etc.