Windows OS Hub
  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu
  • Home
  • About

Windows OS Hub

  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu

 Windows OS Hub / Group Policies / The Sign-in Method Isn’t Allowed to Logon Windows

February 1, 2022 Group PoliciesWindows 10Windows Server 2019

The Sign-in Method Isn’t Allowed to Logon Windows

If you see The sign-in method is not allowed error when trying to logon Windows, it means that the resulting Group Policy settings prevent local sign-in for a current user account. Most often the error appears if you try to sign in to a computer using a guest account or to a domain controller using a user account without domain administrator privileges. However, there may be some other reasons.

The sign-in method you're trying to use isn't allowed. For more info, contact your network administrator.

cant logon windows - The sign-in method you're trying to use isn't allowed

The list of users and groups that are allowed to interactively sign-in to a computer is configured using GPO.

  1. Open the Local Group Policy Editor (gpedit.msc);
  2. Go to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment;
  3. Find Allow log on locally in the list of policies;
  4. The policy contains the list of groups and users allowed to sign in to the computer locally. Allow log on locally GPO option
    Depending on the operating system and computer role, the list of groups allowed to sign-in locally may vary. For example, local sign-in is allowed for the following user groups on workstations running Windows 10 and servers running Windows Server 2022,2019,2016:

    • Administrators
    • Backup Operators
    • Users

    On servers running Windows Server with the Active Directory domain controller role (ADDS), interactive sign-in is allowed for the following groups:

    • Account Operators
    • Administrators
    • Backup Operators
    • Print Operators
    • Server Operators

  5. You can allow local sign-in for other users or groups. To do it, click Add User or Group and select the users you want to add. For example, you prevent non-admin users to log on to the device. To do it, just remove Users group from the policy settings;
  6. After making the changes, update Group Policy settings using the gpupdate /force command (no reboot required).

Also, note that there is another policy to prevent local interactive sign-in to Windows in the same GPO section. The policy is called Deny log on locally. In my case, anonymous local logon under the Guest account is denied on the computer.

Deny log on locally using GPO

You can prevent a specific group (or a user) to log on to the computer locally by adding them to this policy. Since Deny log on locally policy has a higher priority than Allow log on locally, users won’t be able to log on to a computer with the following error:

The sign-in method isn’t allowed.
One of the best practices to secure privileged administrator accounts in a Windows domain is to deny local logon to workstations and servers under domain administrator accounts. To do it, assign Deny log on locally policy for the Domain Admins group to all OUs except Domain Controllers. In the same way, you need to deny sign-in under local accounts.

In a domain environment, multiple GPOs may be assigned to a computer. So to get the policies allowing local sign-in, you need to check the resulting policy settings. You can use the rsop.msc console or the gpresult tool to get the resulting GPO settings on your computer.

Note that users can use interactive RDP sessions to connect to a Windows device (if RDP is enabled on that device) despite being denied local logon. The list of users who are allowed to log in via Remote Desktop is set in the same GPO section using the Allow logon through Remote Desktop Services option.

Another reason why you can see “The sign-in method you are trying to use isn’t allowed” error is when a list of computers a user is allowed to log on to is restricted in the LogonWorkstations user attribute in AD (read more here). Using the Get-ADUser PowerShell cmdlet, you can display a list of computers a user is allowed to log on to (by default, the list is empty):

(Get-ADUser maxbak -Properties LogonWorkstations).LogonWorkstations

In some cases, you may allow a user to log on to the domain controller/ Windows Server hosts over RDP or locally. It is enough to add a user account to the local policy Allow log on locally on your server. Anyway, it will be better than adding a user to the Local Administrators group. However, it is even better to use an RODC domain controller for security reasons.

You can also allow local logon using ntrights (the tool was included in some old Admin Pack versions). For example, to allow local logon for a domain group, run the command below:

ntrights +r SeInteractiveLogonRight -u "GroupName"

To deny local logon:

ntrights -r SeInteractiveLogonRight -u "UserName"

0 comment
0
Facebook Twitter Google + Pinterest
previous post
VMWare ESXi: Errno 28 — No space left on device
next post
Configuring PowerShell Remoting (WinRM) over HTTPS

Related Reading

Configure User’s Folder Redirection with Group Policy

February 3, 2023

Disable Built-in PDF Viewer in Microsoft Edge

February 3, 2023

Join a Windows Computer to an Active Directory...

February 2, 2023

Using Previous Command History in PowerShell Console

January 31, 2023

How to Install the PowerShell Active Directory Module...

January 31, 2023

Leave a Comment Cancel Reply

Categories

  • Active Directory
  • Group Policies
  • Exchange Server
  • Microsoft 365
  • Azure
  • Windows 11
  • Windows 10
  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016
  • PowerShell
  • VMWare
  • Hyper-V
  • Linux
  • MS Office

Recent Posts

  • Configure User’s Folder Redirection with Group Policy

    February 3, 2023
  • Using Previous Command History in PowerShell Console

    January 31, 2023
  • How to Install the PowerShell Active Directory Module and Manage AD?

    January 31, 2023
  • Finding Duplicate E-mail (SMTP) Addresses in Exchange

    January 27, 2023
  • How to Delete Old User Profiles in Windows?

    January 25, 2023
  • How to Install Free VMware Hypervisor (ESXi)?

    January 24, 2023
  • How to Enable TLS 1.2 on Windows?

    January 18, 2023
  • Allow or Prevent Non-Admin Users from Reboot/Shutdown Windows

    January 17, 2023
  • Fix: Can’t Extend Volume in Windows

    January 12, 2023
  • Wi-Fi (Internet) Disconnects After Sleep or Hibernation on Windows 10/11

    January 11, 2023

Follow us

woshub.com
  • Facebook
  • Twitter
  • RSS
Popular Posts
  • Updating List of Trusted Root Certificates in Windows
  • Configure Google Chrome Settings with Group Policy
  • How to Delete Old User Profiles in Windows?
  • How to Find the Source of Account Lockouts in Active Directory?
  • How to Hide or Show User Accounts from Login Screen on Windows 10/11?
  • Configuring Proxy Settings on Windows Using Group Policy Preferences
  • How to Disable or Enable USB Drives in Windows using Group Policy?
Footer Logo

@2014 - 2023 - Windows OS Hub. All about operating systems for sysadmins


Back To Top