## Error message
```text
The user has not been granted the requested logon type at this computer.
```

## TL;DR
Windows is refusing the logon type itself, not the credentials. Open the local security policy on the machine, find the matching logon-right assignment (Allow log on locally, Allow log on through Remote Desktop Services, or Access this computer from the network), and add the user's group. The user signs in normally afterward.

## Steps
1. Ask how the user is trying to sign in: at the keyboard, over RDP, or to a network share.
   Expected: You know which logon type to check: interactive, remoteinteractive, or network.
2. On the target machine open the local security policy, Security Settings, Local Policies, User Rights Assignment.
   Expected: You see the three Allow log on policies and their current member lists.
3. Add the user's group to the matching policy, or fix the domain GPO that overwrites it, then run a policy refresh.
   Expected: A policy refresh completes and the new group appears in the policy.
4. Have the user try the same logon method again.
   Expected: The logon succeeds with no rights error.

## When to use
- The exact message appears for a valid account with a correct password
- Service accounts failing to start with a logon-type error in the event log
- Users moved between OUs suddenly cannot RDP into a server

## When not to use
- The password is actually wrong (the message names the logon type, not credentials)
- The account is locked or disabled (different message appears)
- A domain trust is broken (that surfaces a trust-relationship message instead)

## Why this happens
Windows separates who you are from how you are allowed to connect. Group policy assigns each logon type to specific groups; if a GPO change drops a group from the Allow list, everyone in it gets this exact message even with perfect credentials.

## Edge cases
- Service accounts commonly lose the Log on as a service right after a GPO refresh; check that policy too.
- Deny log on policies override Allow policies, so check both.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_eHBQCXnKJlfyZI9xr3jS-g