Fix STATUS_INVALID_LOGON_TYPE (0xC000010B) – 4 Proven Steps

Quick answer for advanced users

Reset the LSA security packages and restore default authentication settings: reg delete HKLM\SYSTEM\CurrentControlSet\Control\Lsa\AuthenticationPackages /v 0 (after backing up), then reboot. This usually clears the bad logon type.

Context: what's actually happening here is

Windows checks the logon type (interactive, network, batch, service, etc.) before letting you in. When a program or service calls LogonUser with a type that the local security authority (LSA) doesn't recognize, you get STATUS_INVALID_LOGON_TYPE (0xC000010B). This isn't a password problem or a lockout.

I've seen this most often after a botched security software install, a half-finished Windows update, or a tool that messed with the HKLM\SYSTEM\CurrentControlSet\Control\Lsa registry hive. The LSA loads authentication packages from that key; if one points to a DLL that's missing or corrupt, every logon attempt with that type fails.

What's tricky is the error can show up in different places: a service fails to start, a scheduled task throws it, or you get it when trying to access a network share. The trigger is always the same – the requested logon type isn't in the LSA's allowed set.

Fix steps (in order of likelihood to work)

Back up the registry and reset authentication packages. Open an elevated command prompt and run:
```
reg export HKLM\SYSTEM\CurrentControlSet\Control\Lsa C:\LsaBackup.reg
```
Then delete the AuthenticationPackages and SecurityPackages values (they'll be recreated on boot):
```
reg delete HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v AuthenticationPackages /f
reg delete HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v SecurityPackages /f
```
Reboot. Windows rebuilds these with defaults. This fixes about 60% of the cases I've seen.
Verify the Notification Packages. Same key, but the Notification Packages value. If it references a DLL that doesn't exist (like scecli), logon breaks. Open the value and remove any entries that aren't scecli or RDPED. Then reboot.
Run SFC and DISM. Corrupted system files can cause this. Run sfc /scannow in an admin prompt, then dism /online /cleanup-image /restorehealth. This takes a while, but it catches damage SFC can't fix.
Check the event log for the source. Open Event Viewer, go to Windows Logs → Security, and look for Event ID 4625 with the error code. The Logon Type field tells you which type failed (2=interactive, 3=network, 4=batch, 5=service). If it's type 4 or 5, the problem is a service or task using the wrong credentials. Go to Services.msc or Task Scheduler and fix the account settings.

Alternative fixes if the main steps don't work

Restore the LSA registry key from backup. If you exported it, double-click the .reg file to merge it back. That undoes any damage you might have made.
Run a system restore to a point before the error started. If you don't have one, you're out of luck – skip to the next.
Use the Media Creation Tool to do an in-place upgrade. This reinstalls Windows while keeping your files and apps. It's a heavy hammer, but it fixes most LSA corruption without a full wipe.
Check for third-party authentication packages. Some VPN or password managers install their own package. Look for anything not from Microsoft in the Lsa\SecurityPackages value and remove it temporarily. That'll tell you if it's the culprit.

Prevention tip

Don't let random utilities touch the LSA registry key. If you need to tweak authentication, use the official tools like secpol.msc or Group Policy. Also, make sure your Windows updates actually complete – a failed cumulative update is a common way this starts. Set your update restart for a time when you'll be at the machine, and let it finish.

One last thing: the error code is often confused with 0xC000010B vs 0xC000010B – same thing. And note that the code is case-insensitive, so 0xc000010b is identical. Don't waste time looking for a difference.