| Previous | Next |
| ERROR_PASSWORD_CHANGE_REQUIRED | ERROR_INVALID_PIXEL_FORMAT |
ERROR_LOST_MODE_LOGON_RESTRICTION
Lost mode is preventing the requested sign-in.
ERROR_LOST_MODE_LOGON_RESTRICTION is Win32 error 1939 (0x793). The system message directs the user to connect the device to the Internet and have an administrator sign in first. This is a managed-device protection state, not a normal bad-password or account-lockout response.
Why the restriction remains active
- an administrator placed the device into lost mode after loss, theft, or an inventory incident
- the device has not reached its management service to receive updated state or an unlock action
- network access before sign-in is unavailable because Wi-Fi, proxy, certificate, or captive-portal setup is incomplete
- the expected administrator has not completed the first authorized online sign-in
- stale management enrollment or clock/connectivity problems prevent policy acknowledgement
Incident and device evidence
Record the device ID, management tenant, lost-mode activation time and actor, current network state, last management check-in, policy version, attempted account type, and relevant MDM/device-management events. Do not log passwords, recovery keys, tokens, or private location data beyond what the approved incident process requires. Verify the device serial and ownership before any unlock action.
Diagnostic sequence
Confirm in the authoritative management console that the device is intentionally in lost mode and whether an unlock or administrator sign-in is pending. Establish pre-logon Internet connectivity through an approved network, then verify time, certificates, proxy, and enrollment health.
Do not troubleshoot by resetting user passwords or repeatedly attempting local accounts. If the management service shows the device as retired, wiped, or assigned elsewhere, stop and follow asset-recovery procedure rather than bypassing the restriction.
Authorized recovery
Use the organization’s lost-device workflow: validate custody, connect the machine safely, allow policy synchronization, and have an authorized administrator perform the required sign-in or clear lost mode centrally. Escalate when enrollment cannot check in.
Applications and support tools should preserve the exact 1939 status and avoid generic credential prompts. Device fleets need tested pre-logon networking and documented ownership verification so recovery does not require weakening security controls.
Difference from account lockout
ERROR_ACCOUNT_LOCKED_OUT follows an account and usually affects that identity across devices. Error 1939 follows the managed device protection state; even valid ordinary users may be restricted until the device is online and administratively recovered.
Example
A recovered company laptop is still marked lost after being returned. Employees receive 1939 despite correct passwords. IT verifies the asset, connects it to the corporate pre-logon network, clears the lost state, and completes the required administrator sign-in.
References
- Microsoft: System Error Codes (1700–3999)
- Microsoft: Win32 Error Codes in MS-ERREF
- Microsoft: Mobile device management for Windows
Looking for a different code? Search another status or error code.