| Previous | Next |
| ERROR_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT | ERROR_NOLOGON_SERVER_TRUST_ACCOUNT |
ERROR_NOLOGON_WORKSTATION_TRUST_ACCOUNT
A workstation trust account was supplied where a user account is required.
ERROR_NOLOGON_WORKSTATION_TRUST_ACCOUNT is Win32 error 1808 (0x710). Active Directory computer objects have credentials used by the machine and Netlogon secure channel, but they are not ordinary human or service identities for interactive access to a server. The error means the submitted principal was recognized as a workstation trust account and the requested logon type does not accept that account class.
How the wrong account reaches authentication
- automation appends a dollar sign to a user name or substitutes a computer object such as
HOST01$ - a deployment system confuses a machine credential used for domain join with a credential for SMB, WinRM, or an application
- saved credentials or a service configuration contain the computer account rather than a managed service account or user account
- an authentication broker maps a certificate, SID, or directory object to the wrong principal type
- Test code intentionally replays machine-account credentials through an unsupported logon path
Authentication evidence to retain
Record the requested logon type, target server, domain and user name after safe redaction, SID account type, authentication package, source host, relevant Security and Netlogon events, and the component that selected the credential. Never record the password, machine-account secret, Kerberos ticket, NTLM response, or reusable token. The trailing dollar sign is an important clue, but directory lookup of the SID is stronger evidence than string inspection alone.
Troubleshooting steps
Determine whether the caller intended to authenticate a person, a Windows service, or the computer itself. Resolve the submitted SID in Active Directory and inspect the object class. Then identify where the principal was chosen: command-line parameter, service logon configuration, credential manager entry, secret store, domain-join workflow, or protocol-specific machine authentication.
If the operation is part of domain membership or secure-channel maintenance, verify that it uses the documented Netlogon mechanism rather than a general user logon API. If it is ordinary resource access, test with an authorized user, group-managed service account, or other identity supported by the target service. A retry with the same computer account will remain deterministic.
Corrective action
Replace the credential with the intended user or supported service identity and remove stale saved credentials. Keep domain-join and secure-channel secrets isolated from application authentication. For unattended software, grant the minimum rights to a managed service identity instead of repurposing a workstation account.
Developers should validate account type before initiating a user-oriented logon and report the rejected principal category without exposing secrets. Administrators should investigate unexpected machine-account logon attempts because they can indicate a configuration error or credential misuse.
Difference from a broken computer trust
ERROR_NOLOGON_WORKSTATION_TRUST_ACCOUNT says the account category is inappropriate for the requested logon. A secure-channel or trust-password failure concerns the relationship between a domain member and the domain, even when no one tried to use the computer account as a normal user.
Example
A backup agent is configured with BRANCH-PC$ after an installer copies the domain-join identity into its service settings. The file server rejects the session with 1808. Reconfiguring the agent to use its group-managed service account restores access; resetting the workstation trust would not address the incorrect credential selection.
References
Looking for a different code? Search another status or error code.