| Previous | Next |
| ERROR_INVALID_LOGON_HOURS | ERROR_PASSWORD_EXPIRED |
ERROR_INVALID_WORKSTATION
Account workstation restrictions rejected the originating computer
Windows account policy can restrict a user to named workstations. This status identifies that specific restriction and is therefore different from a missing user right on the target computer. A logon can have correct credentials and a valid account yet still be denied because the workstation from which the logon is being attempted is outside the account configuration.
Record the workstation identity supplied to the authentication path and the DC that evaluated the request. Compare it with the account workstation restrictions in the authoritative directory or SAM data. Pay attention to applications and gateways that proxy authentication, because the workstation name presented to the authentication package might not be the UI machine an operator expects. Event 4625 includes Workstation Name and source-network fields that are useful for determining which identity Windows actually evaluated.
What to inspect
- Capture the Workstation Name and source fields from the failed-logon event.
- Inspect the account workstation restrictions in the authoritative account store.
- Check proxies, terminal hosts, or services that can present a different workstation identity.
References
- Microsoft: security event 4625
- Microsoft: Windows authentication credentials
- Microsoft: LsaLogonUser
Looking for a different code? Search another status or error code.