| Previous | Next |
| STATUS_LOGIN_TIME_RESTRICTION | STATUS_IMAGE_MP_UP_MISMATCH |
STATUS_LOGIN_WKSTA_RESTRICTION
The workstation is outside the account’s allowed list
The userWorkstations account attribute can restrict interactive logon to named computers. This status means the authenticating workstation identity did not match the configured list. It is separate from network location, IP address, device compliance, and user-right assignment.
Check the computer name form used by the authentication path and whether the account was recently migrated or the workstation renamed. Clearing the attribute removes the restriction entirely, so correct stale entries rather than disabling the control without review.
What to inspect
- Read userWorkstations and compare every configured NetBIOS or DNS name with the current computer account.
- Review account-change event 4738 for recent edits.
- Confirm that the failure is workstation restriction rather than “log on locally” or “log on through Remote Desktop Services” policy.
References
- Microsoft: account-change audit event 4738
- Microsoft: net user
- Microsoft: Set-ADUser
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.