| Previous | Next |
| STATUS_TOO_MANY_CONTEXT_IDS | STATUS_NOT_REGISTRY_FILE |
STATUS_LOGON_TYPE_NOT_GRANTED
Authentication can succeed before authorisation rejects the logon type
STATUS_LOGON_TYPE_NOT_GRANTED is not a generic credential failure. It indicates that the requested mode of sign-in is not permitted on the target computer. Interactive, network, batch, service and remote-style logons are evaluated differently, so an account can work at one boundary and fail at another. A successful password test or Kerberos ticket does not override User Rights Assignment.
Microsoft documents this status in scenarios where the effective policy for “Access this computer from the network” or the corresponding deny right prevents the account from performing the required network logon. The policy may come from a local setting or a winning domain Group Policy Object, which is why a client-side configuration change is often insufficient.
How to diagnose it precisely
- Identify the logon type from the security event and the actual target computer enforcing it.
- Inspect the effective Allow and Deny User Rights Assignment settings, including group membership and the winning GPO.
- Use
whoami /groupsor directory tools to confirm the groups of the account and, where relevant, the computer account. - Change the narrowest policy scope approved by security administrators; do not grant a broad interactive right merely to make a network workflow succeed.
References
- Microsoft Open Specifications: NTSTATUS reference
- Microsoft: diagnosing User Rights Assignment failures
- Microsoft: network access validation algorithms
Looking for a different code? Search another status or error code.