| Previous | Next |
| ERROR_LOGON_SESSION_COLLISION | ERROR_CANNOT_IMPERSONATE |
ERROR_INVALID_LOGON_TYPE
The caller supplied an invalid logon type selector
Windows distinguishes logon scenarios such as interactive, network, batch, service, and unlock because they have different credential handling and policy requirements. An invalid logon type means the selector itself is not accepted for the API or package request. That is different from ERROR_LOGON_TYPE_NOT_GRANTED, where the type is valid but policy denies that account the corresponding logon right.
Log the numeric logon type before it is converted into package-specific input. Check enum/version mismatches, uninitialized fields, and serialization across process or RPC boundaries. If a wrapper accepts its own logon-mode enum, verify the translation to LOGON32_LOGON_* or SECURITY_LOGON_TYPE values. Do not test user-right assignments until the caller is known to be requesting a defined type; policy changes cannot make an invalid selector valid.
What to inspect
- Record the exact numeric logon type at the failing API boundary.
- Verify enum translation between application, RPC, and LSA/package structures.
- Distinguish an invalid selector from a valid type denied by user-right policy.
References
Looking for a different code? Search another status or error code.