STATUS_INVALID_LOGON_HOURS (0XC000006F) – Time Restrictions Blocking Login

Quick Answer

Run gpupdate /force as admin, then check your account in Active Directory Users and Computers (ADUC) under the Account tab – the Logon Hours button shows the allowed times. If you're locked out, contact your domain admin to extend the hours or create a temporary exception.

What's Actually Happening Here

This error hits when you try to log into a Windows domain computer outside of your account's permitted hours. I've seen it most often with shift workers or students – a client in a warehouse had night-shift employees getting kicked off at 10 PM because someone set logon hours for 8 AM to 6 PM. The error code 0XC000006F is Windows' way of saying "I know who you are, but you're not allowed to be here right now."

The restriction lives in Active Directory, not on the local machine. That means even if you reboot or try a different computer on the same domain, you'll still hit this wall until the admin changes the policy or the clock moves into a permitted time slot.

Fix Steps (Try in Order)

Step 1: Check the Current Time and Time Zone

Sounds dumb, but I've had three cases where the computer's clock was off by hours. Press Win + I, go to Time & Language, and make sure "Set time automatically" is on and your time zone is correct. If the computer thinks it's 2 AM but it's really 10 AM, you'll get blocked.

Step 2: Force a Group Policy Update

Open Command Prompt as administrator, then run:

gpupdate /force

Then restart. Sometimes cached policies can be stale and the update clears the cobwebs. Doesn't always work, but it's cheap and fast.

Step 3: Check Your Account's Logon Hours (Admin Only)

If you're a domain admin or know someone who is, open Active Directory Users and Computers (dsa.msc). Find your user account, right-click, go to Properties, then the Account tab. Click the Logon Hours button. You'll see a grid of days and hours – blue means allowed, white means blocked. If you're trying to log in during a white slot, that's the problem.

To fix it: Select all the white cells (click the top-left cell, then Shift+click the bottom-right), then click the "Logon Permitted" radio button and hit OK. Apply and close. Reboot the user's machine.

Step 4: If You're Not an Admin – Call Your Admin

Seriously. There's no way around this from the locked-out user's side. You cannot change logon hours without Domain Admin or delegated permissions. Resist the urge to mess with local security policies – it won't override AD.

Alternative Fixes (When the Main One Doesn't Work)

Check for Conflicting Policies

Sometimes there's a second policy applying stricter hours from a different OU. On the domain controller, run:

gpresult /scope user /v | find /I "logon"

Look for any mention of logon hours. Cross-reference with the effective policy results.

Reset the Account Locally (Last Resort)

If you absolutely need access and can't reach the admin, you can boot into Safe Mode with Networking as the local Administrator account (if enabled). From there, you can run net user username /times:all – but this only changes local user logon hours, not domain ones. Useless for domain accounts unless you're going local-only.

Prevention Tip

If you're the one managing these policies, set logon hours on security groups instead of individual users. I had a school district where they assigned per-teacher hours – nightmarish. Put all night-shift workers in a group, apply the policy to that group, and they can self-service join or leave it. Also, always include a 30-minute buffer on each end of shifts because people arrive early or stay late. Saves you the 2 AM phone call from a locked-out employee.