| Previous | Next |
| ERROR_BAD_DESCRIPTOR_FORMAT | ERROR_LOGON_SESSION_EXISTS |
ERROR_NOT_LOGON_PROCESS
LSA rejected an authentication call reserved for registered logon processes
LsaRegisterLogonProcess establishes a connection to LSA and verifies that the caller is a logon application. Microsoft documents SeTcbPrivilege as required for that registration, and the function must be called before a logon process uses the corresponding LSA authentication functions. This error therefore concerns caller trust and registration state, not the credentials of the user being authenticated.
Determine whether the application truly needs trusted-logon-process capabilities. Ordinary clients can use LsaConnectUntrusted for package calls that permit untrusted connections, or higher-level authentication APIs for normal logon scenarios. If the component is intended to be a logon process, audit service identity, SeTcbPrivilege, registration success, and handle lifetime. Never grant “Act as part of the operating system” broadly just to suppress the error; that privilege is highly sensitive.
What to inspect
- Verify whether LsaRegisterLogonProcess succeeded and the returned LSA handle is still valid.
- Confirm the design genuinely requires trusted logon-process operations.
- Do not grant SeTcbPrivilege to an ordinary application as a generic workaround.
References
Looking for a different code? Search another status or error code.