Fix 0X0000089C: Logon Processor Alias Error

The 30-Second Fix: Registry Tweak for Standard Users

What's happening here is that Windows Local Security Authority (LSA) sometimes blocks adding user aliases via NetUserAddName (the underlying API). This error 0X0000089C maps to NERR_UnableToAddName_W, which means the logon processor couldn't register the alias. The fastest fix is to bypass a guard in the registry.

Trigger scenario: You're on a Windows 10 Pro (version 22H2) or Windows Server 2019/2022 domain-joined machine, and you try adding a user alias through the GUI or net user command, and get this error.

1. Press Win+R, type regedit, hit Enter.
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
3. Look for a DWORD named RestrictAnonymous. If it's set to 2 (maximum restriction), that's often the culprit. Change it to 1.
4. Reboot.

Why step 3 works: RestrictAnonymous with value 2 tells LSA to block all anonymous access, including certain internal alias registrations. Dropping it to 1 still prevents anonymous enumeration but allows the logon processor to add names. This is documented in Microsoft KB articles for older Windows versions, but it's still relevant on modern builds.

If you can't change the registry (group policy restrictions), skip to the 5-minute fix.

The 5-Minute Fix: Group Policy Adjustment

If the registry didn't work or you can't edit it, the culprit is likely the Network access: Do not allow anonymous enumeration of SAM accounts policy. This is common on corporate domains where security baselines lock things down.

1. Open the Group Policy Management Console (gpedit.msc for local, or gpmc.msc for domain).
2. Navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.
3. Find Network access: Do not allow anonymous enumeration of SAM accounts.
4. Set it to Disabled.
5. Run gpupdate /force and reboot.

What this actually does: When enabled, this policy prevents the LSA from adding aliases that would be visible to anonymous users. The alias registration fails because Windows thinks you're trying to expose a user via anonymous enumeration. Disabling it only allows the API call — it doesn't actually make anything visible anonymously. Most IT admis override this because alias creation is an admin function anyway.

If you're on a domain, you might need your IT admin to push an exception via Group Policy. Expect pushback from security teams — explain that this policy is overly broad for alias management.

The 15+ Minute Fix: User Rights Assignment and SAM Registry Verification

If the first two didn't work, we're dealing with deeper permission issues. This is rare but happens on heavily locked-down systems, especially Windows Server 2022 with Credential Guard enabled.

Check User Rights

1. Open secpol.msc (Local Security Policy).
2. Go to Security Settings > Local Policies > User Rights Assignment.
3. Find Access this computer from the network — ensure your user or group (e.g., Administrators) is listed.
4. Find Allow log on locally — same check.

Why this matters: The logon processor runs under the SYSTEM account but verifies the caller's token against these rights. If you lack network access rights (even for local alias creation), the API call fails with 0X0000089C. It's a subtle interaction.

Restore SAM Registry Key Permissions

The SAM hive stores alias mappings. If permissions got corrupted (common after security scan tools like Microsoft Defender for Identity), the LSA can't write the alias.

1. Run RegEdit as Administrator.
2. Navigate to HKEY_LOCAL_MACHINE\SAM\SAM.
3. Right-click > Permissions.
4. Ensure SYSTEM has Full Control. If missing, add it.
5. Click Advanced, check that inheritance is enabled for HKEY_LOCAL_MACHINE\SAM.
6. Reboot.

Disable Credential Guard (Last Resort)

If you're on Windows 10/11 Enterprise or Server 2022 and Credential Guard is on, it can interfere with alias creation by virtualizing LSA. Disable it via Group Policy:

1. Open gpedit.msc.
2. Go to Computer Configuration > Administrative Templates > System > Device Guard.
3. Set Turn on Virtualization Based Security to Disabled.
4. Reboot twice — Credential Guard requires two reboots to fully remove.

The trade-off: This weakens credential theft protection. Only do this in a controlled lab environment. The better long-term fix is to use a different alias method (e.g., adding users via AD instead of local SAM).

Why this error still exists in 2024

Microsoft never fully fixed the interaction between RestrictAnonymous, SAM enumeration policies, and the logon processor. The 0X0000089C error has been around since Windows NT 4.0. Each security hardening layer added a new way to block alias registration. The fixes above are the most direct paths — anything else is guesswork.

If none of these work, your best bet is to create aliases via PowerShell with the New-LocalUser cmdlet instead of the old net user command. New-LocalUser uses a different API that doesn't trigger the logon processor alias path. It's a workaround, but it works.