| Previous | Next |
| STATUS_DELAY_LOAD_FAILED | STATUS_VDM_DISALLOWED |
STATUS_AUTHENTICATION_FIREWALL_FAILED
An authentication policy or silo blocked the logon
This status is produced when the machine being accessed is protected by an authentication firewall and the account is not allowed to authenticate there. In modern Active Directory, authentication policies and authentication policy silos can restrict where sensitive accounts may be used.
It is not a packet-filter firewall error. Network connectivity and credentials can both be correct while the KDC or authentication policy denies the logon because the user, computer or service account is outside the allowed silo relationship.
What to inspect
- Check authentication policy and authentication policy silo membership for the user and target computer.
- Review domain-controller security events for policy denial details.
- Verify whether the failure only affects protected or tiered administrative accounts.
References
- Microsoft: Authentication Policies and Authentication Policy Silos
- Microsoft Open Specifications: MS-KILE
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.