| Previous | Next |
| STATUS_PASSWORD_RESTRICTION | STATUS_ACCOUNT_RESTRICTION |
STATUS_LOGON_FAILURE
Why the top-level status is not enough
STATUS_LOGON_FAILURE is commonly the outer result of an unsuccessful Windows sign-in. It deliberately groups several failures that occur after the client has attempted authentication: an unknown account, incorrect secret, an account-state restriction, or an identity/domain mismatch can all surface as the same high-level result. Treating it as proof of a mistyped password loses the most useful diagnostic data.
Windows auditing can record a more specific substatus alongside the top-level value. For example, Microsoft documents a failed network authentication where STATUS_LOGON_FAILURE is paired with STATUS_WRONG_PASSWORD. The same documentation also shows that an unexpected domain supplied to NTLM can make a valid password fail because the domain participates in the hash calculation.
What to collect before changing credentials
- Record the target computer, authentication package, logon type, account domain, top-level status, and substatus from the relevant security event.
- Confirm whether the caller intended a local account, a domain account, or a managed/service identity; qualify the name explicitly when ambiguity is possible.
- Compare the failure path for an interactive sign-in and a network or service sign-in, because they can evaluate different policy and credential sources.
- Do not repeatedly reset passwords until the status/substatus combination has ruled out a domain, trust, or policy problem.
References
- Microsoft Open Specifications: NTSTATUS reference
- Microsoft: network access validation algorithms
- Microsoft: Event 4771, Kerberos pre-authentication failed
Looking for a different code? Search another status or error code.