How to fix Error 1328 on Windows 11

by

Why This Error Happens

Error 1328 with the “time restrictions” message typically occurs due to a mismatch between the local system clock and the Domain Controller (DC) or account policy server, causing Kerberos authentication to fail. This can also result from corrupted Group Policy cache files or incorrect Logon Hours settings configured on a local or Active Directory account. In some cases, a botched Windows Update installation leaves a pending file rename operation that conflicts with the authentication service.

Step-by-Step Resolution Guide

Step 1: Verify and Sync System Time

  • Navigate to Settings > Time & Language > Date & Time.
  • Ensure “Set time automatically” is toggled On.
  • Open Command Prompt as Administrator and run: w32tm /resync
  • Confirm the Time Zone matches your physical location exactly.

Step 2: Check Local Account Logon Hours (Local Accounts)

  • Open Command Prompt as Administrator.
  • Run: net user [YourUsername]
  • Look at the “Logon hours allowed” field; if it says “All” you are clear.
  • If restricted, an Administrator must run: net user [YourUsername] /time:all to remove restrictions.

Step 3: Clear Corrupted Group Policy Cache (Domain/Work Accounts)

  • Press Win + R, type gpupdate /force, and press Enter to refresh policies.
  • If the error persists, navigate to C:\Windows\System32\GroupPolicy.
  • Rename the folder to GroupPolicy.old to force Windows to rebuild it.
  • Restart the machine to regenerate policy files and re-check restrictions.

Step 4: Repair System Files

  • Open Command Prompt as Administrator.
  • Run: sfc /scannow
  • Follow up with: DISM /Online /Cleanup-Image /RestoreHealth
  • Restart Windows 11 once the scan completes to apply the fixes.

Alternative or Verification Steps

  • Verify: Log off and attempt to sign back into the account; the system clock in the bottom-right taskbar should match the actual local time exactly.
  • Alternative: If the issue persists on a domain-joined device, contact your Network Administrator to check the “Logon Hours” tab in Active Directory Users and Computers (ADUC), as this server-side setting overrides local fixes.