| Previous | Next |
| ERROR_CONNECTION_COUNT_LIMIT | ERROR_LOGIN_WKSTA_RESTRICTION |
ERROR_LOGIN_TIME_RESTRICTION
The account is outside its permitted logon hours.
ERROR_LOGIN_TIME_RESTRICTION is Win32 error 1239 (0x4D7). Authentication reached an account policy that allows the user to sign in only during configured periods, and the attempted logon occurred outside that schedule. The password may be correct and the account may otherwise be enabled.
Policy context to verify
- account and domain that actually authenticated the request
- domain controller that evaluated the logon
- configured weekly logon-hours bitmap or directory policy
- current time, time zone, and clock synchronization on client and controller
- logon type: interactive, network, service, batch, or remote interactive
- whether an existing session is being renewed or a new session is created
Time-zone and replication pitfalls
Administrative tools can display a schedule in local time while domain policy is stored and evaluated through domain mechanisms. Daylight-saving changes, an incorrect client clock, or replication delay after a policy edit can make the refusal appear one hour or one controller away from expectations. Compare absolute timestamps and identify the evaluating controller.
Administrator actions
Review whether the restriction is intentional for that account and role. Change logon hours only through approved account-management policy, then allow directory replication to complete. For service accounts, scheduled jobs, and unattended agents, a time-limited interactive policy may be inappropriate; use a dedicated account design rather than broadening a human user’s permissions without review.
Application behavior
Do not repeatedly prompt for the same password or label the event “bad credentials.” Tell the user that sign-in is restricted by schedule and, when policy allows, indicate when access resumes. Automated systems should defer until the next permitted interval or fail the job clearly instead of triggering lockout with repeated attempts.
Security logging
- record account identifier in an approved, privacy-conscious form
- store controller, logon type, source workstation, and UTC timestamp
- correlate Windows security audit events with application authentication logs
- never record the supplied password
- distinguish policy denial from expired, disabled, or locked accounts
Difference from workstation restriction
ERROR_LOGIN_WKSTA_RESTRICTION denies the account because of the source computer. Error 1239 denies it because of time. ERROR_ACCOUNT_RESTRICTION is a broader authentication-policy result and may require examining more specific status information.
Example
A contractor account is permitted Monday through Friday from 08:00 to 18:00. A scheduled synchronization starts at 02:00 using that interactive account and receives 1239. The administrator leaves the human restriction intact and moves the job to a separately governed service identity.
References
- Microsoft: System Error Codes (1000–1299)
- Microsoft: NetUserSetInfo function
- Microsoft: USER_INFO_1020 structure
- Microsoft: Audit event 4625
Looking for a different code? Search another status or error code.