Fix ERROR_CTX_ACCOUNT_RESTRICTION (0x1B98) – RDP Blocked

You're trying to RDP into a Windows machine — Server 2019, maybe a Windows 10 Pro box — and you get that vague ERROR_CTX_ACCOUNT_RESTRICTION (0x1B98). The message says "Unable to log you on because of an account restriction." It tells you nothing specific.

I've fixed this more times than I can count. The culprit here is almost always one of three things: the user isn't in the right group, the local security policy blocks interactive logon, or the account itself has conflicting settings. Don't bother chasing your DNS or firewall first — that's rarely the issue.

#1 Cause: User Not in the Remote Desktop Users Group

This is the fix that works 80% of the time. By default, only members of the Remote Desktop Users group and local Administrators can RDP in. If you've created a domain user or a local account and just assumed it'd work — it won't.

Here's the fix:

Open Computer Management (right-click This PC → Manage, or run compmgmt.msc).
Go to System Tools → Local Users and Groups → Groups.
Double-click Remote Desktop Users.
Click Add, type the username (e.g., CONTOSO\jsmith for domain, or just jsmith for local), hit Check Names, then OK.

If the user is an admin, you can skip this — Administrators are allowed by default. But if you're using a non-admin account, this is your first stop.

#2 Cause: Deny Logon Locally User Right

If the user is in the right group but still blocked, the next place to check is the Local Security Policy. This is especially common after domain-wide lockdowns or security hardening. Some GPO or admin might've added the user (or a group they're in) to the "Deny log on locally" or "Deny log on through Remote Desktop Services" policies.

To check this:

Run secpol.msc as admin.
Go to Security Settings → Local Policies → User Rights Assignment.
Look for Deny log on locally and Deny log on through Remote Desktop Services.
Double-click each one. If the user or a group they're in (like Everyone, Guests, or a custom group) is listed, remove them.

Don't just remove blindly — check if it's a corporate policy. But for a standalone server or workstation, you can safely remove users from those deny lists. After you make changes, run gpupdate /force from an admin command prompt, then try RDP again.

#3 Cause: Account Locked or Expired / Smart Card Required

Less common but still pops up. The error 0x1B98 can also fire if the account is locked out, has expired, or the machine enforces smart card logon for interactive sessions. Here's what to check:

Account locked? On the server, run net user <username> /domain (or without /domain for local accounts). Look for "Account active" — if it says No, unlock it with net user <username> /active:yes.
Account expired? Check the expiration date. If it's past, extend it with net user <username> /expires:never.
Smart card required? In Active Directory Users and Computers (or Local Security Policy), check if the user account has "Smart card is required for interactive logon" checked. If you don't use smart cards, uncheck it.

Another gotcha: if the user is using a Microsoft account (like an Outlook.com email) to log into Windows 10, that can trigger this restriction. Use a local account instead — or link the Microsoft account to a local user that's in the Remote Desktop Users group.

Quick-Reference Summary Table

Cause	Fix	Quick Command / Path
User not in Remote Desktop Users group	Add user to that group	`compmgmt.msc` → Local Users and Groups → Groups
Deny log on locally / through RDP	Remove user from deny policies	`secpol.msc` → User Rights Assignment
Account locked, expired, or smart card forced	Unlock, extend, or disable smart card	`net user <username> /domain`

One last thing: if you've tried all three and it still fails, check the Terminal Services (Remote Desktop Services) session limits. Run gpedit.msc and go to Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Connections. Make sure "Restrict Remote Desktop Services users to a single Remote Desktop Services session" is either disabled or set to a number higher than 1. I've seen this cause 0x1B98 when a user is already logged in via console and the policy restricts multiple sessions.

That's it. Nine times out of ten, it's the group membership. Start there, work down the list. You'll have them logged in within five minutes.