Fix 0XC00000ED: The action is restricted for logon processes only

Quick Answer

Boot into Safe Mode with Networking, then run msconfig to disable all non-Microsoft services and startup items. If that doesn't work, check the registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa for a bad value in Authentication Packages or Security Packages.

What's This Error Really About?

The 0XC00000ED error — STATUS_NOT_LOGON_PROCESS — means some process tried to call an API only the Windows logon process (winlogon.exe or lsass.exe) is allowed to use. Usually happens after you install a driver or service that tries to hook into the authentication pipeline. Think antivirus, VPN clients, or third-party credential providers. I had a client last month whose computer bricked right after installing a cheap fingerprint reader driver — same error.

The process triggering it is often lsass.exe (Local Security Authority Subsystem Service). When lsass crashes or gets corrupted, Windows can't handle logon requests. But more often, it's a rogue driver or service that's trying to authenticate itself and Windows says 'nope, you're not the logon process.'

Fix Steps (in order)

1. Boot to Safe Mode — Restart your PC and hold Shift while clicking Restart. Go to Troubleshoot > Advanced Options > Startup Settings > Restart. Press 4 or F4 for Safe Mode, or 5 for Safe Mode with Networking if you need internet.
2. Identify the culprit — Open Event Viewer (eventvwr.msc). Look under Windows Logs > System for errors right at the time of the crash. The source will often say something like 'Service Control Manager' or 'LSA.' Note the service name or driver name.
3. Disable the suspect service — Open Services (services.msc), find the service, double-click, set Startup Type to Disabled, and stop it if it's running. Reboot normally.
4. If the service is unknown, run a clean boot — Open msconfig, go to Services tab, check 'Hide all Microsoft services,' then click Disable all. Go to Startup tab, open Task Manager, disable all startup items. Reboot. If it works, enable services one-by-one to isolate the bad one.
5. Check the registry — If the above fails, open Regedit, go to HKLM\SYSTEM\CurrentControlSet\Control\Lsa. Look at Authentication Packages and Security Packages values. They should list only legitimate DLLs (like msv1_0.dll, schannel.dll, kerberos.dll). Remove any suspicious entries, like a third-party credential provider DLL. Backup the key first.
6. Update or roll back drivers — In Safe Mode, open Device Manager. Look for devices with yellow exclamation marks, especially under 'Security devices' or 'Biometric.' Right-click > Properties > Driver > Roll Back Driver if available, or Update Driver.

Alternative Fixes If the Main One Fails

• System Restore — Boot from Windows installation media, choose Repair your computer > Troubleshoot > Advanced > System Restore. Pick a restore point before the error started.
• Repair install — If you have a Windows ISO, run setup.exe from within Safe Mode and choose 'Keep personal files and apps.' This reinstall Windows without wiping data.
• Last resort: reset lsass recovery — In Safe Mode, open Command Prompt as admin and run sfc /scannow and dism /online /cleanup-image /restorehealth. If lsass files are corrupted, these might fix them.
• Check for malware — Some malware tries to hook lsass. Run a full scan with Malwarebytes or Windows Defender Offline.

Prevention Tips

• Never install third-party logon screens or credential providers unless you absolutely trust the company. Many cheap fingerprint or face recognition drivers cause this.
• Keep a restore point before any driver or service install. You can set Windows to auto-create restore points weekly.
• Use sigverif.exe periodically to verify that all running drivers are signed — unsigned drivers can cause this error.
• If you run a server, enable LSA protection via lsausermem group policy — it prevents non-Microsoft processes from injecting into lsass.

Real talk: half the time I see this error, it's from a bad VPN or antivirus install. If you just installed one of those, boot into Safe Mode, uninstall it entirely, and you're golden. Don't waste time on other fixes first.