How to fix Error 1385 on Windows 11

by

Why This Error Happens

Error 1385 occurs when the security policy on the local or domain-level computer does not include the specific user or group in the list of accounts allowed to use a particular logon type (such as Network, Interactive, RDP, or Service logon). This is typically caused by restrictive Local Security Policy settings under “User Rights Assignment,” a Group Policy Object (GPO) pushed from a domain controller that overrides local settings, or the account being removed from a required local group (like Remote Desktop Users). It essentially means Windows recognizes the credentials as valid but has been explicitly configured to deny that specific type of access.

Step-by-Step Resolution Guide

Step 1: Check Local Security Policy for User Rights Assignment

  • Press Win + R, type secpol.msc, and press Enter to open Local Security Policy.
  • Navigate to Security Settings > Local Policies > User Rights Assignment.
  • Locate policies such as “Allow log on locally,” “Allow log on through Remote Desktop Services,” or “Access this computer from the network.”
  • Double-click the relevant policy and click Add User or Group to include the affected account.

Step 2: Verify the Account is Not Explicitly Denied

  • In the same User Rights Assignment folder, check policies prefixed with “Deny,” such as “Deny log on locally” or “Deny log on through Remote Desktop Services.”
  • If the user or a group they belong to (e.g., “Guests” or a custom security group) appears here, remove them from this deny list.
  • Click Apply and OK to save the changes.

Step 3: Confirm Group Membership for Remote Access

  • Open Computer Management (right-click Start > Computer Management).
  • Go to Local Users and Groups > Groups.
  • Double-click Remote Desktop Users (if applicable) and ensure the affected account is listed as a member.
  • If missing, click Add, type the username, and click Check Names before confirming.

Step 4: Force Group Policy Update

  • Open Command Prompt as Administrator.
  • Run the command: gpupdate /force
  • Restart the computer to ensure the updated security policies are fully applied before attempting to log in again.

Alternative or Verification Steps

  • Verify the Fix: Attempt to log in using the affected credentials via the specific logon type that previously failed (e.g., RDP session or network share access) to confirm the “1385” error no longer appears in the Event Viewer (under Windows Logs > Security).
  • Alternative Solution: If the machine is domain-joined, run gpresult /h report.html to generate a report; this can reveal if a Domain-level GPO is overriding your local settings, which would require adjustment by a Domain Administrator rather than locally.