Logon failure: the user has not been granted the requested logon type at this computer

Question

Logon failure: the user has not been granted the requested logon type at this computer

Krishna Priya Cherungottil 20

I have added a user with Admin privilege in my machine. I have a console application which tries for windows authentication. I am trying this in 2 ways one with ADVAPI's LogonUser and other with PrincipalContext's ValidateCredentials method. But both are returning Logon failure: the user has not been granted the requested logon type at this computer error. what can be the reason? please suggest. TIA

RLWA32 49,666 Reputation points

2023-08-08T12:22:16.02+00:00

the user has not been granted the requested logon type

So what logon type is the code requesting? Interactive? Batch? Service?

Can the newly added user account successfully logon through the usual gui logon process?

Generally, its helpful to provide a meaningful snippet of the code that is being used and details about the errors encountered (e.g., error codes and full text). It saves time for all concerned -- the Questioner and community members that would like to help.
Anonymous

2023-08-09T01:43:33.3966667+00:00

Hi @Krishna Priya Cherungottil , What project are you working on? What do you want to log in for?
Krishna Priya Cherungottil 20 Reputation points

2023-08-09T04:44:30.35+00:00
Thank you for the response!

In my real application, the application login happens with windows authentication.

Console application I have created for testing purpose.

I have tried 2 methods to get windows authenticated. Both APIs return same error:

"Logon failure: the user has not been granted the requested logon type at this computer"

Already tried the following steps to resolve the issue :

Tried running the Application in admin mode.

The same code is working fine in other machine, so Verified the settings in Local security Policy in both the machine, but it did not help

The user have admin privileges.

Tried LogonUser with different logon type.

While using PrincipalContext, Line no : 49 , where the list of user accounts in my machine are printed, the username which I am trying to authenticate is listed.
Anonymous

2023-08-09T06:14:09.7033333+00:00
Obviously this is a policy group issue for you.

Log in to the server with a domain administrator account.

Run Group Policy Management as administrator.

Open the start menu > type "gpedit.msc".

Right click and select run as administrator. Under Computer Configuration > Go to Windows Settings > Security Settings > Local Policies > User Rights Assigned By .

Right click on Allow Logon Locally > Properties.

Click Add Users and Groups, then click Add a new user account. To immediately reflect the above changes in Group Policy Management, the following should be done:

Open CMD as administrator. Run the following command to apply the policy update.

gpupdate /force
RLWA32 49,666 Reputation points

2023-08-09T08:28:20.1133333+00:00

@Anonymous Even on a domain-joined machine wouldn't a local account that is a member of the Administrator's group be allowed to logon locally when authenticating against the local account database?

My system is not domain-joined so I can't check this but the local security policy allows several groups to logon locally and the Administrators group is among them.
Anonymous

2023-08-15T02:42:58.1266667+00:00

Hi @Krishna Priya Cherungottil , Is there any update in this issue？
Krishna Priya Cherungottil 20 Reputation points

2023-08-16T04:09:20.48+00:00

Hi, I tried out the solution you provided. But it didn't help.

Click Add Users and Groups, then click Add a new user account. - Your comment

In Add Users and Groups, I didn't get an option Add a new user account. (Please find screenshot)

In "Enter object name to select" , I tried giving my "UserName", but i did not get any match.

My "UserName" is added in Administrators group. Administrators have Allow Logon Locally permission too. (Please find screenshot) Then why this happens. (As I mentioned earlier, I have compared the settings with with the working machine. They both look similar. )

Is there anything else I am missing? Thanks IN advance.

Thanks IN advance.
Krishna Priya Cherungottil 20 Reputation points

2023-08-16T04:44:55.7766667+00:00
Hi, I tried out the solution you provided. But it didn't help.

Click Add Users and Groups, then click Add a new user account. - Your comment

In Add Users and Groups, I didn't get an option Add a new user account. (Please find screenshot)

In "Enter object name to select" , I tried giving my "UserName", but i did not get any match.

My "UserName" is added in Administrators group. Administrators have Allow Logon Locally permission too. (Please find screenshot) Then why this happens. (As I mentioned earlier, I have compared the settings with with the working machine. They both look similar. )

Is there anything else I am missing? Thanks IN advance.
RLWA32 49,666 Reputation points

2023-08-16T06:09:04.5966667+00:00

Are there any entries in "Deny log on locally"?
Krishna Priya Cherungottil 20 Reputation points

2023-08-17T05:09:40.6366667+00:00

Yes, it have Guest in "Deny log on locally" property
Krishna Priya Cherungottil 20 Reputation points

2023-08-17T05:21:27.2333333+00:00

Yes, "Guest" is set as "Deny log on locally"

Your answer

RLWA32 49,666 Reputation points

2023-08-08T12:22:16.02+00:00

the user has not been granted the requested logon type

So what logon type is the code requesting? Interactive? Batch? Service?

Can the newly added user account successfully logon through the usual gui logon process?

Generally, its helpful to provide a meaningful snippet of the code that is being used and details about the errors encountered (e.g., error codes and full text). It saves time for all concerned -- the Questioner and community members that would like to help.
Anonymous

2023-08-09T01:43:33.3966667+00:00

Hi @Krishna Priya Cherungottil , What project are you working on? What do you want to log in for?
Krishna Priya Cherungottil 20 Reputation points

2023-08-09T04:44:30.35+00:00

Thank you for the response!

In my real application, the application login happens with windows authentication.

Console application I have created for testing purpose.

I have tried 2 methods to get windows authenticated. Both APIs return same error:

"Logon failure: the user has not been granted the requested logon type at this computer"

Already tried the following steps to resolve the issue :

Tried running the Application in admin mode.

The same code is working fine in other machine, so Verified the settings in Local security Policy in both the machine, but it did not help

The user have admin privileges.

Tried LogonUser with different logon type.

While using PrincipalContext, Line no : 49 , where the list of user accounts in my machine are printed, the username which I am trying to authenticate is listed.
Anonymous

2023-08-09T06:14:09.7033333+00:00

Obviously this is a policy group issue for you.

Log in to the server with a domain administrator account.

Run Group Policy Management as administrator.

Open the start menu > type "gpedit.msc".

Right click and select run as administrator. Under Computer Configuration > Go to Windows Settings > Security Settings > Local Policies > User Rights Assigned By .

Right click on Allow Logon Locally > Properties.

Click Add Users and Groups, then click Add a new user account. To immediately reflect the above changes in Group Policy Management, the following should be done:

Open CMD as administrator. Run the following command to apply the policy update.

gpupdate /force
RLWA32 49,666 Reputation points

2023-08-09T08:28:20.1133333+00:00

@Anonymous Even on a domain-joined machine wouldn't a local account that is a member of the Administrator's group be allowed to logon locally when authenticating against the local account database?

My system is not domain-joined so I can't check this but the local security policy allows several groups to logon locally and the Administrators group is among them.
Anonymous

2023-08-15T02:42:58.1266667+00:00

Hi @Krishna Priya Cherungottil , Is there any update in this issue？
Krishna Priya Cherungottil 20 Reputation points

2023-08-16T04:09:20.48+00:00

Hi, I tried out the solution you provided. But it didn't help.

Click Add Users and Groups, then click Add a new user account. - Your comment

In Add Users and Groups, I didn't get an option Add a new user account. (Please find screenshot)

In "Enter object name to select" , I tried giving my "UserName", but i did not get any match.

My "UserName" is added in Administrators group. Administrators have Allow Logon Locally permission too. (Please find screenshot) Then why this happens. (As I mentioned earlier, I have compared the settings with with the working machine. They both look similar. )

Is there anything else I am missing? Thanks IN advance.

Thanks IN advance.
Krishna Priya Cherungottil 20 Reputation points

2023-08-16T04:44:55.7766667+00:00

Hi, I tried out the solution you provided. But it didn't help.

Click Add Users and Groups, then click Add a new user account. - Your comment

In Add Users and Groups, I didn't get an option Add a new user account. (Please find screenshot)

In "Enter object name to select" , I tried giving my "UserName", but i did not get any match.

My "UserName" is added in Administrators group. Administrators have Allow Logon Locally permission too. (Please find screenshot) Then why this happens. (As I mentioned earlier, I have compared the settings with with the working machine. They both look similar. )

Is there anything else I am missing? Thanks IN advance.
RLWA32 49,666 Reputation points

2023-08-16T06:09:04.5966667+00:00

Are there any entries in "Deny log on locally"?
Krishna Priya Cherungottil 20 Reputation points

2023-08-17T05:09:40.6366667+00:00

Yes, it have Guest in "Deny log on locally" property
Krishna Priya Cherungottil 20 Reputation points

2023-08-17T05:21:27.2333333+00:00

Yes, "Guest" is set as "Deny log on locally"

Share via

Logon failure: the user has not been granted the requested logon type at this computer

Your answer