What does Windows error code 1385 (ERROR_LOGON_TYPE_NOT_GRANTED) mean?

 
Previous Next
ERROR_TOO_MANY_CONTEXT_IDS ERROR_NT_CROSS_ENCRYPTION_REQUIRED

ERROR_LOGON_TYPE_NOT_GRANTED

User Rights Assignment does not permit this account to use the requested logon type

This status is the explicit logon-right denial commonly surfaced when a valid account is used for a valid logon type but policy does not grant that type. Windows has separate rights for local, network, batch, service, and remote-interactive scenarios, along with deny counterparts. Authentication can therefore know the account and still refuse to create the requested logon session.

Use event 4625 to identify the Logon Type, then inspect effective User Rights Assignment on the computer where LSA is making the decision. Check both the account and its group memberships; also check matching Deny rights. Domain GPO can replace a local policy list, which is why a manually added service account may lose “Log on as a service” after policy refresh. Grant the narrow right to an appropriate group rather than broadening unrelated filesystem or registry permissions.

What to inspect

  • Identify the failed Logon Type from event 4625 or the calling API.
  • Check both allow and deny user-right assignments for the account and its groups.
  • Verify the effective domain GPO before editing local security policy.

References


Looking for a different code? Search another status or error code.