How to fix Error 1239 on Windows 11

by

Why This Error Happens

Error 1239 (ERROR_INVALID_LOGON_HOURS) occurs when a user account has been configured with specific “Logon Hours” restrictions—either through Local Users and Groups or Active Directory—and the login attempt falls outside that permitted window. This is a security policy enforcement mechanism, not a corruption issue, meaning Windows is correctly blocking access based on the account’s time-based permissions. The mismatch is often caused by incorrect time zone settings on the client or domain controller, or by an administrator setting overly restrictive hours by mistake.

Step-by-Step Resolution Guide

  1. Verify the system clock and time zone: Right-click the clock in the taskbar → Adjust date and time → ensure Set time zone automatically and Set time automatically are toggled ON. A skewed clock relative to the domain controller can trigger false restriction errors.
  2. Check Logon Hours (Domain Account): On a domain controller, open Active Directory Users and Computers (dsa.msc), locate the user, right-click → Properties → Account tab → Logon Hours. Adjust the grid to allow access during the required time and click OK.
  3. Check Logon Hours (Local Account via Command Prompt): Since the GUI (lusrmgr.msc) doesn’t expose logon hour settings directly, open Command Prompt as Administrator and run:
    net user <username>
    to view current restrictions, then use:
    net user <username> /time:M-F,08:00-18:00
    (adjust days/hours as needed) or /time:all to remove restrictions entirely.
  4. Force Group Policy/AD Replication: If changes were made on a Domain Controller, run gpupdate /force on the client machine and allow time for AD replication (or run repadmin /syncall on the DC) before retrying login.
  5. Restart the affected machine: Once hours are updated, restart the Windows 11 device to ensure the Local Security Authority (LSA) re-validates the account against the new policy.

Alternative or Verification Steps

  • Verify the fix: Attempt to log in again within the newly configured time window; check the Event Viewer (Windows Logs > Security, Event ID 4625) to confirm the “Account Logon Time Restriction” failure reason no longer appears.
  • Alternative: If the account is a service or automation account that needs 24/7 access, set logon hours to /time:all so it is never restricted by time-of-day policies.