The Group Policy Client service failed the sign-in: how to fix it

What the error means

After you type your password, Windows 10 or 11 shows:

The Group Policy Client service failed the sign-in. Access is denied.

Older versions of Windows used the word logon instead of sign-in; the fixes are the same. The Group Policy Client service (service name gpsvc) applies policy settings while your account loads. Microsoft lists it as an automatic, always-installed service, and it is hardened so that even administrators can’t easily stop or restart it in Services. That’s why the common advice to “set the service to Automatic and restart it” rarely helps: it is already automatic, and the buttons are greyed out.

In Microsoft Q&A, a Microsoft employee answering this error said it is usually caused by a problem with the user profile, which explains why deleting and rebuilding the profile often works. Other causes raised in Microsoft Q&A threads include wrong permissions on the profile, corrupted system files after an interrupted update or a hard shutdown, and, on work PCs, faulty policies or old FSLogix versions.

First: get into Windows another way

Restart the PC once and try again; a one-off failure can clear on its own. If it doesn’t, you need a way in that doesn’t use the broken account:

• Another administrator account. If the PC has one, sign in with it. This is the easiest route for every fix below.
• Safe Mode. On the sign-in screen, hold Shift and choose Power > Restart. Then go to Troubleshoot > Advanced options > Startup Settings > Restart and press 4. Some users can sign in to the affected account in Safe Mode; if you can and it is an administrator account, open Command Prompt as administrator and run net user administrator /active:yes to switch on the built-in Administrator account, then restart and use that.
• The recovery environment. The same Troubleshoot menu gives you System Restore and a Command Prompt even if no account works. Our guide to WinRE shows every way to open it.

Turn the built-in Administrator off again when you’ve finished, with net user administrator /active:no.

One account or every account?

What you see	Likely area	Start with
One account fails, others sign in	That user’s profile	Fixes 1 to 3
A standard account fails, an admin account works	Usually still the profile	Fixes 1 to 3
Every account fails	System files or registry	Fixes 4 and 5
A domain user fails on every PC	Roaming profile or policies	The work PC section

Before changing anything, the logs can confirm the cause. In Event Viewer, look under Windows Logs > Application for errors from the User Profile Service source, and under Applications and Services Logs > Microsoft > Windows > GroupPolicy > Operational around the time of the failed sign-in.

Fix 1: Check the ProfileList key for a .bak entry

Windows keeps a registry key for each profile, named after the account’s security identifier (SID). When a profile fails to load, a copy of that key ending in .bak can appear, and Windows then follows the wrong entry. This step comes from Microsoft’s own answer in the Q&A thread listed under Official sources. Back up the key before you touch it.

1. Signed in with another admin account, open PowerShell and run Get-LocalUser | Select-Object Name, SID to find the SID of the broken account. For a Microsoft account, use the local name shown in C:\Users.
2. Press Win + R, type regedit and go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList.
3. Right-click ProfileList, choose Export and save the file somewhere safe.
4. Find the key that matches the SID. Click it and check that ProfileImagePath points to the right folder, such as C:\Users\Sam.
5. If there are two keys for that SID and one ends in .bak: rename the one without .bak by adding .old, then remove .bak from the other. If only the .bak key exists, simply remove .bak from its name.
6. In the key you kept, if there are RefCount and State values, set both to 0. Restart and try the account.

Fix 2: Check the profile folder permissions

Microsoft’s answer also points at permissions. Open C:\Users, right-click the affected user’s folder and choose Properties > Security. The user, SYSTEM and Administrators should all have Full control. If the user is missing or only has read access, click Edit, add the account and give it Full control, then restart.

Fix 3: Move to a new profile

If the profile itself is damaged, a fresh one is the dependable fix. Create a new account in Settings > Accounts > Other users (Family & other users on Windows 10), make it an administrator if needed, and sign in once so its folder is built. Then copy Documents, Desktop, Pictures and other personal folders from the old profile in C:\Users. Copy the folders inside the profile, not the whole profile, so hidden settings files that may be corrupted stay behind.

Once everything is moved and checked, you can remove the old profile cleanly with the steps in how to delete a user profile in Windows. Back up anything you need first; deleting the profile folder removes its files.

Fix 4: Repair system files or roll back

When every account fails, suspect Windows itself, especially after an update was interrupted or the PC lost power. From an admin Command Prompt in Safe Mode, run:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Our guide to running sfc /scannow explains how to read the results. If you can’t reach Windows at all, use Troubleshoot > Advanced options > System Restore from the recovery environment and pick a point from before the problem started. A restore point doesn’t touch your personal files.

Fix 5: Check the Svchost registry entries

This fix is community-documented, quoted in Microsoft Q&A threads rather than in a Microsoft article, so treat it as a later step and export each key before editing. After a failed update some PCs have been left with missing entries that the service needs.

1. Open HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gpsvc and read ImagePath. Don’t change anything in this key.
2. On current Windows 10 and 11 builds it normally ends in -k netsvcs -p. In that case open HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost, double-click netsvcs and make sure gpsvc is on its own line in the list. Add it if it’s missing.
3. If ImagePath ends in -k GPSvcGroup instead, the Svchost key needs a GPSvcGroup multi-string value containing GPSvc, plus a GPSvcGroup subkey with two DWORD values: AuthenticationCapabilities set to 12320 (decimal) and CoInitializeSecurityParam set to 1. Type the names exactly; one widely copied guide misspells the second value, which leaves it ignored.
4. Restart the PC.

On a work or school PC

On a domain, this error can follow one user to every computer, which points at their roaming profile or the policies applied to them. Microsoft Q&A answers suggest renaming the user’s roaming ntuser.dat so a fresh one is built, and moving the account to a test OU with no policies linked to see whether a policy is the cause. For Azure Virtual Desktop and other FSLogix setups, Microsoft’s FSLogix documentation lists this message as a known issue in previous FSLogix versions, so update FSLogix first. The Group Policy Management Console helps you review what’s linked to the user’s OU.

Fixes to skip

Several popular guides suggest taking ownership of the gpsvc registry key from TrustedInstaller and changing its Type value. That changes how a protected system service runs, and none of them show how to undo it, so leave it for last-resort professional repair. Resetting Winsock is also widely suggested, but it resets network settings and has no clear link to profile loading. And don’t delete ntuser.dat in your own profile: it holds your account settings, and removing it won’t bring them back. If a similar message names a different service, see Please wait for the System Event Notification Service.

Related guides

• Please wait for the System Event Notification Service: how to fix it
• How to delete a user profile in Windows 11 and 10 (properly)
• WinRE: what the Windows Recovery Environment is and how to open it
• How to run sfc /scannow in Windows 11 and 10 (and read the results)
• Group Policy Management Console on Windows 11: how to install and open it

Official sources

• Group Policy Client service failed the sign-in. Access is denied (Microsoft Q&A)
• The Group Policy Client service failed the sign-in (Microsoft Q&A)
• Troubleshooting issues with Group Policy processing (FSLogix, Microsoft Learn)