| Previous | Next |
| ERROR_TOO_MANY_CONTEXT_IDS | ERROR_NT_CROSS_ENCRYPTION_REQUIRED |
ERROR_LOGON_TYPE_NOT_GRANTED
User Rights Assignment does not permit this account to use the requested logon type
This status is the explicit logon-right denial commonly surfaced when a valid account is used for a valid logon type but policy does not grant that type. Windows has separate rights for local, network, batch, service, and remote-interactive scenarios, along with deny counterparts. Authentication can therefore know the account and still refuse to create the requested logon session.
Use event 4625 to identify the Logon Type, then inspect effective User Rights Assignment on the computer where LSA is making the decision. Check both the account and its group memberships; also check matching Deny rights. Domain GPO can replace a local policy list, which is why a manually added service account may lose “Log on as a service” after policy refresh. Grant the narrow right to an appropriate group rather than broadening unrelated filesystem or registry permissions.
What to inspect
- Identify the failed Logon Type from event 4625 or the calling API.
- Check both allow and deny user-right assignments for the account and its groups.
- Verify the effective domain GPO before editing local security policy.
References
- Microsoft: logon type not granted
- Microsoft: security event 4625
- Microsoft: Windows authentication credentials
Looking for a different code? Search another status or error code.