| Previous | Next |
| ERROR_ACCOUNT_RESTRICTION | ERROR_INVALID_WORKSTATION |
ERROR_INVALID_LOGON_HOURS
The authentication attempt occurred during a time interval in which the account is not allowed to log on
Windows account policy can restrict the hours during which a principal may authenticate. This status is more specific than the generic account-restriction or logon-failure results: the relevant condition is the account logon schedule. The decision is made during authentication, before an ordinary access check against a file or service DACL could grant the requested resource access.
Verify the account logon-hours configuration and the time basis used by the domain environment. Capture the target domain controller and current client/server time when the failure occurs. Do not confuse this with Kerberos clock skew: ERROR_TIME_SKEW means protocol timestamps differ beyond tolerance, whereas invalid logon hours means the policy schedule itself does not permit the account to log on at that time. Security event 4625 can help confirm the logon type and detailed failure context.
What to inspect
- Inspect the account logon-hours schedule in the authoritative account database.
- Record the DC handling authentication and verify current time/time-zone assumptions.
- Use event 4625 to distinguish policy-hour denial from bad credentials or clock skew.
References
- Microsoft: security event 4625
- Microsoft: Windows authentication credentials
- Microsoft: Kerberos clock tolerance
Looking for a different code? Search another status or error code.