| Previous | Next |
| ERROR_LOGON_FAILURE | ERROR_INVALID_LOGON_HOURS |
ERROR_ACCOUNT_RESTRICTION
The account reached authentication policy checks and was blocked by a restriction
This result is broader than a wrong-password failure. Windows can deny a logon because of account restrictions such as blank-password policy, permitted logon hours, workstation restrictions, or another policy condition associated with the account and requested logon type. The existence of more specific Win32 errors for logon hours, workstation restrictions, and disabled accounts means the surrounding status and Security log remain important.
Inspect the 4625 failure event and the account properties rather than repeatedly changing the password. Record whether the request was interactive, network, batch, or service logon and which policy source applies to the target computer. Domain policy and local policy can affect different parts of the decision. If a service fails, check its configured logon type and rights; if interactive access fails, compare the same account on another workstation only after confirming that workstation restrictions and applied policy are equivalent.
What to inspect
- Read the event 4625 status/substatus and requested logon type.
- Inspect account logon hours, workstation restrictions, and applicable password/account policy.
- Compare effective local/domain policy on the actual target computer.
References
- Microsoft: security event 4625
- Microsoft: Windows authentication credentials
- Microsoft: logon type not granted
Looking for a different code? Search another status or error code.