diff --git a/src/Handler/Utils/LMS.hs b/src/Handler/Utils/LMS.hs
index 42a2c2dc7..68c5501a7 100644
--- a/src/Handler/Utils/LMS.hs
+++ b/src/Handler/Utils/LMS.hs
@@ -154,10 +154,14 @@ _lmsUserToDelete cutoff = to $ lmsUserToDelete cutoff
 
 
 lmsUserToResetTries :: LmsUser -> Bool
-lmsUserToResetTries LmsUser{..} = lmsUserResetTries && lmsUserLocked && lmsUserStatus == Just LmsBlocked -- only reset blocked learners
+lmsUserToResetTries LmsUser{..} = lmsUserResetTries && lmsUserLocked && 
+                                  (lmsUserStatus == Just LmsBlocked || lmsUserStatus == Just LmsExpired) 
+                                  -- only reset blocked learners
 
+-- | Answers "Should the LMS lock a user out?" 
+--   Note that LmsUserLocked only logs the current LMS state, not what it should be.
 lmsUserToLock :: LmsUser -> Bool
-lmsUserToLock LmsUser{..} = lmsUserLocked && not (lmsUserResetTries && isNothing lmsUserStatus)
+lmsUserToLock LmsUser{..} = isNothing lmsUserStatus -- only open LMS should be accessible
 
 lmsUserStaff :: LmsUser -> Bool
 lmsUserStaff = const False -- legacy, currently ignored
diff --git a/src/Jobs/Handler/LMS.hs b/src/Jobs/Handler/LMS.hs
index 01c2bbb14..d80c76ad1 100644
--- a/src/Jobs/Handler/LMS.hs
+++ b/src/Jobs/Handler/LMS.hs
@@ -305,8 +305,24 @@ dispatchJobLmsReports qid = JobHandlerAtomic act
                   E.where_ $ lreport E.^. LmsReportIdent          E.==. luser E.^. LmsUserIdent
                       E.&&.  lreport E.^. LmsReportQualification  E.==. E.val qid
                 )
-      -- E) lock expired learneds: happens during JobLmsDequeue only
-      -- F) update lock and received
+      
+      -- E) reset status for learners that had their tries just resetted as indicated by LmsOpen
+      E.update $ \luser -> do
+        E.set luser [ LmsUserStatus     E.=. E.nothing
+                    , LmsUserResetTries E.=. E.false ]
+        E.where_ $  E.val qid E.==. luser E.^. LmsUserQualification              
+              E.&&. E.isNothing (luser E.^. LmsUserEnded   )
+              E.&&. E.isJust    (luser E.^. LmsUserReceived) -- seen before, for otherwise it might not have been started yet
+              E.&&. luser E.^. LmsUserResetTries
+              E.&&. E.exists (do 
+                  lreport <- E.from $ E.table @LmsReport
+                  E.where_ $ lreport E.^. LmsReportIdent          E.==. luser E.^. LmsUserIdent
+                      E.&&.  lreport E.^. LmsReportQualification  E.==. E.val qid
+                      E.&&.  lreport E.^. LmsReportResult         E.==. E.val LmsOpen
+                      E.&&.  lreport E.^. LmsReportLock           E.==. E.true
+                )          
+      -- F) lock expired learneds: happens during JobLmsDequeue only
+      -- G) update lock and received
       let updateReceivedLocked lockstatus = E.update $ \luser -> do -- due to the absence of UPDATE..FROM in esqueleto, we call update twice
             E.set luser [ LmsUserReceived E.=. E.justVal now
                         , LmsUserLocked   E.=. E.val lockstatus ]