0X00000552

Fix 0X00000552: Logon Process Restriction Error

Windows Errors Intermediate 👁 9 views 📅 May 26, 2026

This error means a non-logon app tried to use a logon-only API. The fix is to grant SeTcbPrivilege or run the app under SYSTEM context.

I know this error is infuriating. You're staring at 'The requested action is restricted for use by logon processes only' and your app just crashed or won't start. Don't panic. This is a privilege issue, not a hardware failure.

The Quick Fix

You need to grant the account running the app the SeTcbPrivilege (Act as part of the operating system) right. Here's how:

  1. Open Local Security Policy (secpol.msc) as Administrator.
  2. Go to Security Settings > Local Policies > User Rights Assignment.
  3. Find Act as part of the operating system and double-click it.
  4. Add the user or service account that's throwing error 0X00000552.
  5. Click OK, close the console, then restart the app or service.

That's it. If the error was caused by a missing privilege, this fix works 9 times out of 10.

Why This Works

The error ERROR_NOT_LOGON_PROCESS (0X00000552) means your application called an API that only logon processes like Winlogon or LSASS are allowed to use. The most common API here is LogonUser, CreateProcessAsUser, or ImpersonateLoggedOnUser. If your app isn't running with the right token — one that has the SeTcbPrivilege — Windows slaps it with this error.

By granting SeTcbPrivilege, you're telling Windows: 'This process is trusted enough to act as a logon authority.' It's a powerful right, so don't hand it out to random users. Give it only to the service account or user that really needs it.

Less Common Variations

Sometimes the above fix isn't enough. Here are two edge cases I've seen in the wild:

Service Running Under LocalSystem Already

If your service already runs as LocalSystem (which has SeTcbPrivilege by default) but still gets the error, check for a different issue: the service might be trying to call LogonUser with a NULL or invalid domain. Make sure the domain parameter matches the machine name or is empty if using a local account. I've seen this trip up developers who hardcoded domain names in a test environment.

Windows 10/11 Security Hardening

On newer Windows versions (especially 22H2+), the SeTcbPrivilege alone may not cut it if your app is also trying to access LSA secrets or use LsaLogonUser directly. In that case, you also need to give the account Log on as a batch job (SeBatchLogonRight) and ensure the app is not blocked by Windows Defender Application Control (WDAC). Check Event Viewer under Applications and Services Logs/Microsoft/Windows/CodeIntegrity/Operational for block events.

Prevention

To avoid this error in the future:

  • Don't make normal apps pretend to be logon processes. Re-architect your app to use CreateProcessAsUser from a properly privileged service instead.
  • Audit your service accounts. Only grant SeTcbPrivilege to accounts that absolutely need it. Over-privileging is a security risk.
  • Test in a VM. Before deploying, test your app with a stripped-down token to catch privilege issues early.
  • Check for Windows updates. Microsoft has tightened logon API access in cumulative updates. Keep your system current.

If you're still stuck after trying all this, drop a comment with your exact scenario — I've seen nearly every variation of this error and I can help narrow it down.

Was this solution helpful?

0X00000552 ERROR_NOT_LOGON_PROCESS logon process restriction SeTcbPrivilege LSASS error Windows API access denied act as part of the operating system user rights assignment service logon failure token privilege missing