Fix: STATUS_CTX_LOGON_DISABLED (0XC00A0037) Interactive Logon

I know this error is infuriating. You’re trying to Remote Desktop into your work machine or a client’s server, and instead of a login prompt, you get 0XC00A0037 with the message “Your interactive logon privilege has been disabled.” It’s like the system is saying, “Nope, you’re not allowed to sit at the desk.”

This tripped me up the first time too, especially after a Windows 10 22H2 update or a quick group policy refresh. The fix is straightforward — we just have to undo something that got flipped. Let me walk you through the three most common culprits, starting with the one I see 80% of the time.

Cause 1: Group Policy or Local Security Policy blocked your user

This is the big one. Somewhere — either in a domain Group Policy or your Local Security Policy — your user account got added to the “Deny log on through Remote Desktop Services” list. This can happen silently when an admin runs a script that applies a security template, or after a feature update resets some permissions.

Here is how to check and fix it:

1. Press Win + R, type secpol.msc, and hit Enter. This opens the Local Security Policy console.
2. Go to Security Settings > Local Policies > User Rights Assignment.
3. Find “Deny log on through Remote Desktop Services”. Double-click it.
4. If you see your username, a group you belong to (like Users or Everyone), or NT AUTHORITY\NETWORK SERVICE in that list — that’s your problem. Select it and click Remove.
5. Click OK, then close secpol.msc.
6. Open a Command Prompt as admin (Win + X > Command Prompt (Admin)) and run:

gpupdate /force

Then try RDP again. If the error goes away, great. If not, move to the second cause.

Cause 2: The user is not in the Remote Desktop Users group

Even if your interactive logon privilege isn’t explicitly denied, you still need to be in the Remote Desktop Users group on the target machine. This is a common miss — especially on Windows 10 Pro or Windows 11 Pro machines that aren’t domain-joined.

Here’s the fix:

1. Right-click This PC on the desktop or in File Explorer, and choose Properties.
2. Click Remote Desktop on the left, then Select users that can remotely access this PC.
3. Click Add, type your username (like john.doe or DOMAIN\john.doe), and click Check Names to verify it resolves.
4. Click OK twice.

Alternate path: open lusrmgr.msc from the Run dialog, go to Groups, double-click Remote Desktop Users, and add your user there. Same result.

After you do this, sign out of the target machine completely and try connecting again. I’ve seen cases where just adding the user to the group isn’t enough — you need to log off so the new group membership takes effect.

Cause 3: The “Allow log on through Remote Desktop Services” right is missing

Less common but nasty — someone (or a script) removed the “Allow log on through Remote Desktop Services” privilege for the Remote Desktop Users group. This can happen after a security baseline is applied, like the Microsoft Security Compliance Toolkit. When the “Allow” right is missing, even if you’re in the right group, you get the same 0XC00A0037 error.

To fix it:

1. Open secpol.msc again.
2. Go to Security Settings > Local Policies > User Rights Assignment.
3. Find “Allow log on through Remote Desktop Services”. Double-click it.
4. If you do not see Remote Desktop Users in the list, click Add User or Group, type Remote Desktop Users, click Check Names, then OK.
5. Also, make sure Administrators is there (it usually is, but double-check).
6. Click OK, close the console, and run gpupdate /force again.

A quick reboot after this doesn’t hurt, but it’s usually not required. Just signing out and back in should do it.

Quick-reference summary table

That’s it. One of these three will get you back in. If none of them work, check if the target machine has RDP enabled at all — sometimes a Windows Update turns it off. You can verify by going to Settings > System > Remote Desktop and making sure the toggle is on.

Good luck. You’ll beat this error.