What does NTSTATUS 0xC000006E (STATUS_ACCOUNT_RESTRICTION) mean?

STATUS_ACCOUNT_RESTRICTION

The credentials were recognized, but account policy blocks this logon

STATUS_ACCOUNT_RESTRICTION (0xC000006E) means authentication reached an account restriction that prevents the requested logon or use of the account. It is not a synonym for User Account Control elevation and should not be diagnosed as a generic “run as administrator” problem.

What to capture

• Record the account, domain or local authority, logon type, source workstation, target computer, and the first security/authentication event for the attempt.
• Inspect the companion status or substatus when available; the outer restriction result can cover several account-policy conditions and the narrower value is often the useful discriminator.
• Check effective account restrictions such as permitted logon context, workstation or time restrictions, password/account state, and service/batch/interactive rights as applicable to the actual logon path.

Recovery

Correct the specific account restriction or use an account intended for that logon type. Do not disable UAC, grant local administrator rights, or weaken unrelated security policy merely because the logon was restricted.

If the restriction is removed and authentication then returns a different status, preserve that result separately. A bad password, disabled account, expired password, trust failure, or missing logon right identifies a different boundary and can require a different owner.

Official references

• Microsoft Open Specifications: NTSTATUS values
• Microsoft: Using NTSTATUS values