How to fix Error 1367 on Windows 11

by

Why This Error Happens

Error 1367 occurs when an authentication mechanism (often a service, application, or misconfigured script) submits a logon request using a logon type value that Windows LSA (Local Security Authority) does not recognize as valid. This typically stems from corrupted or outdated authentication packages, misconfigured Group Policy settings related to “Logon Type” restrictions, or third-party security software interfering with the Windows authentication API. It can also surface when custom applications call LogonUser() with an incorrect or deprecated dwLogonType parameter.

Step-by-Step Resolution Guide

Step 1: Verify the Logon Type Configuration

  • Check any custom scripts, services, or third-party applications that call the Windows LogonUser() API.
  • Ensure the logon type value passed matches a valid constant (e.g., LOGON32_LOGON_INTERACTIVE = 2, LOGON32_LOGON_NETWORK = 3, LOGON32_LOGON_BATCH = 4, LOGON32_LOGON_SERVICE = 5).
  • If using PowerShell or a scheduled task, confirm the task’s “Run as” logon trigger isn’t set to an unsupported or legacy type.

Step 2: Review Local Security Policy Settings

  • Open secpol.msc and navigate to Local Policies > User Rights Assignment.
  • Confirm the account/service in question has the appropriate rights: “Allow log on locally,” “Log on as a batch job,” or “Log on as a service,” depending on the logon method being used.
  • If the required right is missing, add the affected user or service account and reboot the system to apply changes.

Step 3: Repair Corrupted Authentication Components

  • Run System File Checker to repair damaged system files tied to LSA and authentication:
  sfc /scannow
  • Follow up with a DISM health restore in case the Windows image itself is corrupted:
  DISM /Online /Cleanup-Image /RestoreHealth
  • Restart the machine after both commands complete.

Step 4: Check for Interfering Group Policies

  • Open gpedit.msc and navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.
  • Look for any policies related to “Network security: Restrict NTLM” or “Interactive logon” that may be blocking specific logon types.
  • Temporarily disable suspicious policies, reboot, and test whether the error persists.

Step 5: Update or Reinstall the Application Triggering the Error

  • If a specific third-party application (VPN client, RDP tool, or custom login service) triggers Error 1367, check the vendor’s site for an updated build compatible with Windows 11.
  • Uninstall and cleanly reinstall the application if no update resolves the issue, as its authentication module may be outdated or corrupted.

Alternative or Verification Steps

  • After applying the fixes, open Event Viewer (eventvwr.msc) and check the Security log for Event ID 4625 or related logon failure entries to confirm Error 1367 no longer appears.
  • If the issue persists, test logon behavior using a different account type (local admin vs. domain account) to isolate whether the problem is account-specific or system-wide.