| Previous | Next |
| ERROR_ALIAS_EXISTS | ERROR_TOO_MANY_SECRETS |
ERROR_LOGON_NOT_GRANTED
A valid logon scenario was rejected by machine logon-right policy
Windows applies user-right policy to logon types such as interactive, network, batch, and service logon. This legacy Win32 result has the same broad diagnostic theme as ERROR_LOGON_TYPE_NOT_GRANTED: the requested logon class is recognized, but the account or its groups do not have the required allow right or are affected by a deny right. It is not a file ACL failure and changing a resource DACL will not grant the logon itself.
Record the numeric Logon Type in event 4625 and evaluate effective User Rights Assignment on the computer performing the logon. Deny rights generally take precedence over corresponding allow rights, and domain Group Policy can overwrite local settings. Identify the target system: a service logon failure must be fixed on the service host, while a network logon can be denied on the server accepting the connection. Do not grant broad rights such as Everyone merely to make the error disappear.
What to inspect
- Use event 4625 to identify the exact requested Logon Type.
- Inspect effective allow and deny user-right assignments on the target computer.
- Check domain GPO precedence before changing local security policy.
References
- Microsoft: security event 4625
- Microsoft: logon type not granted
- Microsoft: Windows authentication credentials
Looking for a different code? Search another status or error code.