STATUS_ACCOUNT_RESTRICTION (0XC000006E) – The Real Fix

You’re staring at STATUS_ACCOUNT_RESTRICTION (0XC000006E) and your first thought is probably “what did I do wrong with my password?” I get it. But this error is almost never about a mistyped password. It’s Windows telling you that even though you entered the right credentials, some rule is blocking you from logging in. Let’s jump straight to what fixes this.

The Quick Fix: Check Logon Hours and Workstation Restrictions

Most of the time, 0XC000006E appears because of two specific account restrictions: logon hours or workstation restrictions. If you’re on a domain, your admin probably set these without telling you. If you’re on a local machine, a group policy change might’ve locked you out.

Fix for Domain Users (most common)

1. Contact your domain admin and ask them to check the user account in Active Directory Users and Computers (ADUC).
2. Open the user’s properties, go to the Account tab.
3. Look at Logon Hours – if it shows blocks (white spaces) during the current time, that’s your culprit. Click the block to allow access, then save.
4. Check Log On To – if only specific computers are listed, and yours isn’t one, add your workstation name (NetBIOS format, like “OFFICE-PC”).
5. Also check Account options – make sure “Account is sensitive and cannot be delegated” is not checked unless it’s intentional.

I had a client last month whose whole sales team couldn’t log in after a manager accidentally set logon hours from 9 AM to 5 PM only. One quick edit in ADUC and they were back in business.

Fix for Local Accounts (standalone PC)

1. If you can’t log in at all, boot into Safe Mode with Command Prompt (hold Shift while clicking Restart from the login screen, then Troubleshoot > Advanced Options > Startup Settings).
2. Once in Command Prompt (as Administrator), run:
   

   net user %username% /logonhours:all

3. If you don’t know the exact username, use net user to list accounts.
4. Reboot and try logging in again.

Why This Error Happens

0XC000006E isn’t a generic “access denied.” It’s a specific code that the Local Security Authority (LSA) throws when it checks the user’s token against restrictions defined in the account or group policy. The LSA finds that the user’s credentials are valid, but one of these restrictions fails:

• Logon hours – you’re trying to log in outside allowed times.
• Workstation restriction – your computer name isn’t on the allowed list.
• Account is disabled or expired – less common but still possible.

Think of it like a bouncer checking your ID. Your ID is real, but the bouncer says “you’re not on the guest list” or “it’s after 2 AM.” That’s exactly what Windows is doing.

Less Common Variations of the Same Issue

Sometimes the error shows up in different places. Here’s where I’ve seen it outside the login screen:

Connecting to a Network Share

If you’re trying to access \server\share and get 0XC000006E, the same restrictions apply. Open Computer Management on the server, go to Local Users and Groups, check the user’s properties for logon hours or workstation restrictions.

Running a Service Under a Specific Account

Services that run as a user can trigger this error if the user’s logon hours block service startup. I once spent two hours debugging a SQL Server Agent job that failed every night at 11 PM. The service account had logon hours set to 8 AM–6 PM. Changed it to “Logon allowed 24 hours” and the job ran fine.

RDP Sessions

Remote Desktop users might see this error if the account’s logon hours don’t match the time of the RDP connection. Check Remote Desktop Services > Connection Authorization Policies if you’re on a terminal server.

How to Prevent This Going Forward

• Audit user accounts quarterly – especially if you’re the admin. Look for logon hour changes made by other staff.
• Use “User cannot change logon hours” sparingly – locking this down rigidly leads to support calls at 8 PM.
• Document workstation restrictions – if an account is set to only log on to certain computers, keep a list. When a user gets a new PC, update the list immediately.
• Check group policy – sometimes the restriction comes from a GPO like “Deny log on locally” or “Deny log on through Remote Desktop Services.” Run gpresult /h gp.html to see what policies apply.

In short: 0XC000006E is a rule-based lockout, not a password problem. Look at logon hours first, workstation restrictions second. When in doubt, boot Safe Mode and reset the logon hours. That’ll get you back in fast.