| Previous | Next |
| ERROR_LOGIN_TIME_RESTRICTION | ERROR_INCORRECT_ADDRESS |
ERROR_LOGIN_WKSTA_RESTRICTION
The account is not authorized to log on from this computer.
ERROR_LOGIN_WKSTA_RESTRICTION has decimal value 1240 (0x4D8). The account’s allowed-workstations policy excludes the source computer used for the attempted logon. This is an account restriction even when the password is valid and the destination service is reachable.
What to identify
- account domain and security identifier
- source computer name as seen by the authenticating system
- domain controller or local security authority that evaluated the request
- configured allowed-workstations list
- logon type and destination service
- recent computer rename, domain migration, or cloned-image activity
Name mismatches that create surprises
The policy may use workstation names while users think in terms of DNS aliases, asset labels, or Remote Desktop gateways. A renamed computer, duplicate short name, or access through an intermediary can therefore fail even though the visible device appears approved. Log the authoritative source name used in authentication rather than only the UI label.
Administrator response
Confirm that the restriction is intentional and that the source machine is managed and trusted for the account’s role. Update the account’s allowed-workstations setting through approved directory tools when access is legitimate. Do not add a broad wildcard merely to clear the error; the restriction often exists to contain credential use.
Application response
Stop repeated credential prompts and explain that the account is not permitted from this workstation. Retrying from the same machine with the same account will not help until policy or the source identity changes. For unattended software, choose a service identity designed for the intended hosts instead of reusing a restricted interactive account.
Telemetry and audit
- capture UTC time, source computer, destination, and logon type
- correlate with security event 4625 and domain-controller records
- record policy generation or last-change time where available
- avoid storing passwords or reusable credential material
- alert on attempts from unexpected unmanaged machines
Difference from nearby account restrictions
ERROR_LOGIN_TIME_RESTRICTION is based on permitted hours. Error 1240 is based on the source workstation. User-rights assignment failures, disabled accounts, and logon-type restrictions can produce other security status values and should not be collapsed into this code.
Example
An administrator account is limited to two privileged access workstations. A support engineer tries to use it from a normal laptop and receives 1240. The help desk does not reset the password; the engineer moves to an authorized workstation, and the security team investigates why the restricted credential was attempted elsewhere.
References
- Microsoft: System Error Codes (1000–1299)
- Microsoft: NetUserSetInfo function
- Microsoft: USER_INFO_1014 structure
- Microsoft: Audit event 4625
Looking for a different code? Search another status or error code.