| Previous | Next |
| ERROR_USER_DELETE_TRUST_QUOTA_EXCEEDED | ERROR_REMOTE_PRINT_CONNECTIONS_BLOCKED |
ERROR_AUTHENTICATION_FIREWALL_FAILED
The target computer rejected the account through an authentication firewall.
ERROR_AUTHENTICATION_FIREWALL_FAILED is Win32 error 1935 (0x78F). Windows uses “authentication firewall” for restrictions that limit where protected accounts, services, or computers may authenticate. Credentials can be valid and the domain reachable while policy intentionally denies this account-to-computer combination.
Why policy blocks the sign-in
- the account is assigned to an authentication policy silo that does not include the target computer or service
- the target host is outside the authorized administrative tier or protected-account boundary
- a computer, user, or service account was moved but its silo assignment or policy was not updated
- automation uses a privileged identity on a general-purpose host contrary to credential-isolation policy
- directory replication or time/Kerberos prerequisites prevent the target from evaluating the expected policy state
Security evidence to retain
Capture account SID and type, target computer, requested logon type, authentication package, source host, domain controller, authentication policy/silo assignments, relevant Security and Kerberos events, and policy change timestamps. Do not record passwords, tickets, keys, or token contents. Treat the denial as a policy decision until evidence proves stale or inconsistent policy.
How to diagnose
Verify the account and target assignments in Active Directory and evaluate the effective authentication policy. Confirm that the target computer is an enforced member where required and that the attempted logon path is one the policy permits. Compare results from an explicitly authorized host rather than weakening policy on the failing machine.
Check directory replication, Kerberos availability, time synchronization, and recent moves between silos. If a service account is involved, identify the actual machine presenting the credential; delegation or scheduled-task placement can make that different from the user-facing server.
Corrective action
Use an account authorized for the target, run the task from an approved administrative host, or correct the policy/silo assignment through change control. Do not add broad exceptions merely to make a legacy workflow work; redesign the workflow to preserve credential boundaries.
Applications should display the target and policy nature of the denial without prompting endlessly for the same password. Administrators should monitor repeated attempts because they can expose tiering violations or stolen-credential use.
Difference from bad credentials
Invalid password and unknown-account errors reject identity proof. Error 1935 can be returned after the account is known because policy says that identity must not authenticate to this computer.
Example
A domain-admin account assigned to a protected administration silo is used for an interactive logon on a developer workstation. The password is correct, but Windows returns 1935. Signing in through the approved privileged access workstation succeeds without changing the password.
References
- Microsoft: System Error Codes (1700–3999)
- Microsoft: Win32 Error Codes in MS-ERREF
- Microsoft: Authentication policies and silos
- Microsoft: Configure protected accounts
Looking for a different code? Search another status or error code.