The logon attempt failed. The user account used to log on is not permitted to log on from this computer. This restriction is configured on the user’s domain account.
- The code in the Logon Type field specifies the logon method used. The following table explains the logon type code:
Logon TypeLogon TitleDescription
||A user logged on to this computer at the console.
||A user or computer logged on to this computer from the network.
||Batch logon type is used by batch servers, where processes might run on behalf of a user without the user’s direct intervention.
||A service was started by the Service Control Manager.
||This computer was unlocked.
||A user logged on to a network and the user password passed to the authentication package in unhashed (plain text) form. Possibly, the unhashed password was passed across the network.
||A caller (process, thread, or program) cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections.
||A user logged on to this computer remotely using Terminal Services or a Remote Desktop connection.
||A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials.
- The Authentication Package field values are specified in the following table:
|MSV1_0 and Microsoft_Authentication_Package_MV_1
||Both refer to the MSV1_0 authentication package in the NTLM SSP (Security Support provider), which supports the NTLMv2, NTLM, and LM authentication protocols and local SAM lookups.
||Refers to the Kerberos authentication package in the Kerberos SSP, which supports the Kerberos protocol.
- The Workstation name field specifies the NetBIOS name of the remote computer that originated the logon request. If no information is displayed in this field, either a Kerberos logon attempt failed because the ticket could not be decrypted, or a non-Windows NetBIOS implementation or utility did not supply the remote computer name in the logon request.
- This message includes the user name and the domain information for the user account that logged on, the name of the logon process that logged the user on, the type of authentication credentials that were presented, and a logon GUID (globally unique identifier).
- The Caller fields specify the process that received the logon request.
- The Transited Services field specifies the services or programs in order through which the user’s credentials have been authenticated by using constrained delegation.
- The Source Network Address and Source Port fields specify the source IP address and source port number for the remote computer that sent the logon request.