Fix STATUS_LOGON_NOT_GRANTED (0XC0000155) Network Error

1. Stale or Wrong Saved Credentials in Credential Manager

This is the most common reason you see 0XC0000155. Some app or service – usually a scheduled task, a mapped network drive, or a Windows service – tried to authenticate with credentials that are either expired, wrong, or have changed. Windows keeps a hidden cache of passwords in Credential Manager. If the password for the target resource changed and you didn't update it there, you get this error.

Here's how to check and fix it.

1. Open Control Panel. Type credential manager into the search bar at the top right.
2. Click Credential Manager (icon with a key).
3. Select Windows Credentials (the section on the left).
4. Scroll through the Generic Credentials list. Look for entries that mention the server name or IP address you're connecting to. They'll look like TERMSRV/server01 or MicrosoftOffice16_Data or something referencing your network path.
5. Click the arrow to expand each suspicious entry, then click Remove. Confirm the deletion.
6. Also check Windows Credentials (the other section at the top). Remove any entries that look old or for the same server.
7. After removing those, restart the app or service that was failing. If it's a mapped drive, open File Explorer, right-click the drive, and choose Disconnect. Then remap it using Map network drive and check Sign in with different credentials if needed.

What to expect after this step: If the credential cache was the problem, the error goes away immediately. You'll be prompted for fresh credentials the next time the connection is made. For scheduled tasks, you might need to re-enter the password in the task's properties.

2. Denied Logon Rights in Local Security Policy

Less common but still frequent: your user account (or the account the service uses) doesn't have the right to log on over the network. Windows has a security policy that explicitly lists who can and cannot access this machine remotely. The error 0XC0000155 pops up when the policy blocks the account.

This usually happens after a security hardening change or a group policy update. I've seen it most often in domain-joined machines where IT tightened the Deny log on through Remote Desktop Services or Access this computer from the network settings.

1. Press Win + R, type secpol.msc, and hit Enter. If you get a UAC prompt, click Yes.
2. In the left pane, expand Local Policies and click User Rights Assignment.
3. Look for Deny log on through Remote Desktop Services. Double-click it. Check if your account or any group your account belongs to is listed. If it is, select it and click Remove.
4. Now look for Access this computer from the network. Double-click it. Make sure your account or a group containing your account is in that list. If not, click Add User or Group, type your username, and click OK.
5. Also check Deny log on locally and Deny log on through Remote Desktop Services – sometimes these block network access too.
6. Close the Local Security Policy window. You usually don't need to reboot, but restarting the service or the app helps.

What to expect after this step: If a policy was blocking you, the error goes away right after you close the policy window. If it doesn't, try restarting the machine. Group policy updates sometimes need a reboot to fully apply.

3. Corrupted or Mismatched Credential Provider (NTLM/Kerberos)

This one is trickier. Sometimes the error is caused by a corrupted Windows credential provider package – specifically the NTLM or Kerberos stack. I've run into this after a Windows update went sideways, or after some third-party security software messed with the authentication chain.

You'll know it's this case if you've tried the first two fixes, the error still shows up, and you see something like Logon failure: account currently disabled or Logon failure: the user has not been granted the requested logon type in the Event Viewer (System log, source Security-Kerberos or Security-NetLogon).

1. Press Win + R, type eventvwr.msc, and hit Enter.
2. Go to Windows Logs > System. On the right, click Filter Current Log. In the Event sources dropdown, check Security-Kerberos, Security-NetLogon, and Microsoft-Windows-LSA. Click OK.
3. Look for event IDs 4625 (logon failure) or 4776 (credential validation failure). The detail might say Status: 0xC0000155.
4. If you see consistent failures from the same target machine or service, run these commands in an elevated Command Prompt (right-click CMD and choose Run as administrator):

net stop kdc /y
net start kdc
klist purge -li 0x3e7

The first two restart the Kerberos Key Distribution Center service. The third purges all cached Kerberos tickets (including the machine account's).

5. Also flush the NTLM cache. Run:

net stop NtLmSsp /y
net start NtLmSsp

6. If the problem persists, check the Network Provider Order. Open Network and Sharing Center > Change adapter settings. Right-click your network adapter, choose Properties. In the list, find Client for Microsoft Networks and File and Printer Sharing for Microsoft Networks. Make sure they're both checked. If one is missing, click Install > Client > Add to put it back.

What to expect after this step: The error should vanish after purging the cache and restarting services. You might need to re-enter credentials for any active connections. If the provider order was wrong, the fix is instant – you'll see network shares immediately.

Quick-Reference Summary Table

If none of these work, you might be dealing with a domain trust issue or a firewall blocking port 445 (SMB). Check the firewall rules and run dcdiag if you're on a domain. But in my ten years of help desk work, these three fixes resolve 95% of 0XC0000155 cases.