| Previous | Next |
| STATUS_ALIAS_EXISTS | STATUS_TOO_MANY_SECRETS |
STATUS_LOGON_NOT_GRANTED
The requested logon type is not granted by policy
Windows logon rights are policy-controlled. This status means the account may be valid but is not allowed to use the requested logon type, such as interactive, service, batch, or network logon.
This is different from a password failure. The diagnostic path is User Rights Assignment, domain Group Policy, and the logon type requested by the caller.
What to inspect
- Identify the logon type and account SID.
- Check local security policy and effective domain Group Policy for allow and deny logon rights.
- For service accounts, verify the service logon right rather than adding the account to broad administrative groups.
References
- Microsoft: Configure security policy settings
- Microsoft: Allow log on locally policy
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.