the user has not been granted the requested logon type at this computer
This skill fixes the Windows logon error stating the user has not been granted the requested logon type at this computer, the classic sign of a missing local logon right. It shows helpdesk staff how to confirm whether the user needs interactive, remote desktop, or network logon rights, and how to grant the right via group policy. Not for password or account-lockout failures.
Error message
The user has not been granted the requested logon type at this computer.TL;DR
Windows is refusing the logon type itself, not the credentials. Open the local security policy on the machine, find the matching logon-right assignment (Allow log on locally, Allow log on through Remote Desktop Services, or Access this computer from the network), and add the user's group. The user signs in normally afterward.
Steps
Ask how the user is trying to sign in: at the keyboard, over RDP, or to a network share. Expected: You know which logon type to check: interactive, remoteinteractive, or network.
On the target machine open the local security policy, Security Settings, Local Policies, User Rights Assignment. Expected: You see the three Allow log on policies and their current member lists.
Add the user's group to the matching policy, or fix the domain GPO that overwrites it, then run a policy refresh. Expected: A policy refresh completes and the new group appears in the policy.
Have the user try the same logon method again. Expected: The logon succeeds with no rights error.
When to use
- The exact message appears for a valid account with a correct password
- Service accounts failing to start with a logon-type error in the event log
- Users moved between OUs suddenly cannot RDP into a server
When not to use
- The password is actually wrong (the message names the logon type, not credentials)
- The account is locked or disabled (different message appears)
- A domain trust is broken (that surfaces a trust-relationship message instead)
Why this happens
Windows separates who you are from how you are allowed to connect. Group policy assigns each logon type to specific groups; if a GPO change drops a group from the Allow list, everyone in it gets this exact message even with perfect credentials.
Edge cases
- Service accounts commonly lose the Log on as a service right after a GPO refresh; check that policy too.
- Deny log on policies override Allow policies, so check both.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_eHBQCXnKJlfyZI9xr3jS-g