The sign-in method you’re trying to use isn’t allowed: how to fix it

Applies to: Windows 11, Windows 10 and Windows Server, including domain-joined PCs and Remote Desktop sign-ins.

What the error means

The full message on the sign-in screen is: The sign-in method you’re trying to use isn’t allowed. For more info, contact your network administrator. Your password was accepted. Windows refused the type of sign-in, because the account isn’t allowed to sign in interactively (at the keyboard) on that machine.

Windows decides this with two user rights. Allow log on locally lists who may sign in at the console; on PCs and member servers it includes Administrators, Backup Operators and Users by default. Deny log on locally lists who may not, and Microsoft documents that it supersedes the Allow setting when an account is in both. The error appears when:

• the account was removed from the local Users group (or only belongs to Guests);
• someone edited Allow log on locally and removed Users, or added a group the account belongs to into Deny log on locally;
• a standard domain user tries to sign in at a domain controller, where only administrators and certain operator groups are allowed by default;
• an Active Directory account is limited to specific computers.

An administrator can confirm it in Event Viewer under Windows Logs > Security: a failed logon event 4625 with the failure reason “The user has not been granted the requested logon type at this machine” (status 0xC000015B).

Fix 1: Add the account back to the Users group

This is the most common cause on home and small-office PCs, often after someone changed an account type or tidied up groups. Sign in with an administrator account, then open Command Prompt as administrator and check the account’s groups:

net user "AccountName"

Look at Local Group Memberships. If *Users (or *Administrators) isn’t listed, add it back:

net localgroup Users "AccountName" /add

For a Microsoft account, use the name shown by net user with no arguments, which lists the local account names. On Windows 11 or 10 Pro you can do the same in Computer Management (compmgmt.msc) under Local Users and Groups > Groups > Users. Sign out and try the affected account again. No restart is needed; user rights apply at the next sign-in.

Fix 2: Check “Allow log on locally”

On Windows Pro, Enterprise and Server, press Win + R, type secpol.msc and press Enter. Go to Local Policies > User Rights Assignment and open Allow log on locally.

• On a normal PC or member server, it should include Administrators, Backup Operators and Users.
• If Users is missing, select Add User or Group, type Users, select Check Names and OK.
• If the Add User or Group button is greyed out, the setting comes from a domain Group Policy and has to be changed there (Fix 4).

Windows Home doesn’t include secpol.msc. There, Fix 1 is the practical fix, because Home normally keeps the default rights.

Fix 3: Check “Deny log on locally”

In the same User Rights Assignment list, open Deny log on locally. By default it’s empty on most systems (it may list Guest). If you find Users, Everyone, Authenticated Users or the specific account there, remove it, because a deny entry wins even if the account is also allowed. Then sign out and test.

Be careful not to lock yourself out: never add Administrators or Everyone to this list, and test changes with a second admin account signed in.

Fix 4: On a domain: Group Policy and “Log On To” limits

On a work PC, local changes are overwritten by Group Policy at the next refresh, so the fix belongs in the domain’s policy. For an administrator:

• Run gpresult /h C:\gp.html (or rsop.msc) on the affected PC and look for which GPO sets Allow log on locally or Deny log on locally.
• Edit that GPO in Group Policy Management under Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment, then run gpupdate /force on the PC.
• Check the user in Active Directory Users and Computers: on the Account tab, Log On To should be All computers, or include this PC’s name.
• If the computer is a domain controller, standard users aren’t meant to sign in at its console. That’s a security default, not a fault, so use an admin account or work from another PC.

If domain sign-ins fail with a different message, see The Active Directory Domain Services is currently unavailable. For an account that’s been locked out after wrong passwords, see The referenced account is currently locked out.

Fix 5: If it happens over Remote Desktop

Remote Desktop sign-ins are controlled by a separate right, Allow log on through Remote Desktop Services, plus Deny log on through Remote Desktop Services. By default the allow list includes Administrators and Remote Desktop Users. To let a standard user connect, add them to that group:

net localgroup "Remote Desktop Users" "AccountName" /add

You can also do this from Settings > System > Remote Desktop > Remote Desktop users. For Microsoft Entra ID (Azure AD) joined virtual machines, the account usually needs the Virtual Machine User Login or Virtual Machine Administrator Login role on the VM in Azure, and Conditional Access policies can also block the sign-in, so involve whoever manages your Azure tenant.

No administrator account to sign in with?

Every fix above needs an administrator. If the only admin account is the one that’s blocked:

• On a work or school PC, contact your IT department. They can fix the policy remotely.
• On a home PC, try any other account that’s an administrator, including one you set up for another family member.
• If there isn’t one, the last resort is Troubleshoot > Reset this PC from the Windows Recovery Environment with Keep my files. It reinstalls Windows and returns its settings to defaults while keeping personal files, but you’ll need to reinstall apps. Back up anything important first if you can, and check whether the drive is protected with BitLocker; you’ll need the recovery key.

If you get in but Windows Hello stops working, see Your PIN is no longer available due to a change.

Related guides

• The referenced account is currently locked out: how to fix it
• Your PIN is no longer available due to a change to the security settings
• The Active Directory Domain Services is currently unavailable
• You don’t currently have permission to access this folder

Official sources: for more detail, see Microsoft’s own pages:

• Microsoft Learn: Allow log on locally (security policy setting)
• Microsoft Learn: Deny log on locally (security policy setting)

Frequently asked questions

Is my password wrong?

No. A wrong password gives a different message. This error appears after Windows checks the password, when it finds the account isn’t allowed to sign in that way on that PC.

Why can’t I sign in to the domain controller with my normal account?

By default, domain controllers only allow administrators and a few operator groups to sign in at the console. That’s deliberate. Use an admin account, or manage the server remotely from your own PC.

Can I fix it on Windows Home without secpol.msc?

Usually yes. Home doesn’t let you edit user rights in a console, but its default rights include the Users group, so adding the account back to Users with net localgroup from an administrator account fixes most cases.

Does a Guest account cause this?

It can. Accounts that only belong to the Guests group are often denied local sign-in. Put the account in Users instead of Guests.