Overview
The error "The sign-in method you’re trying to use isn’t allowed" means a security policy is blocking that account’s logon type (local or remote). This guide shows how to grant the right logon permissions and clear deny policies.
A security policy can block an account’s sign-in method.
Key Takeaways
- The error is caused by User Rights Assignment policies.
- Add the account to "Allow log on locally" (or through Remote Desktop).
- Remove it from the matching "Deny log on" policy.
- Antivirus or domain GPOs can also enforce these restrictions.
Why It Happens
Windows controls which accounts may sign in locally or remotely via User Rights Assignment. If an account is missing the "Allow log on" right, or is listed under the corresponding "Deny log on" policy, this error appears.
Fix 1 — Allow Log On Locally
1. Press Windows key + R, type secpol.msc, and press Enter (Pro/Enterprise).
2. Go to Local Policies > User Rights Assignment.
3. Open "Allow log on locally" and add the user or their group, then OK.
4. For remote logons, also check "Allow log on through Remote Desktop Services".
Fix 2 — Remove From the Deny Logon List
1. In the same User Rights Assignment section, open "Deny log on locally".
2. Remove the affected user/group if listed.
3. Repeat for "Deny log on through Remote Desktop Services".
4. Run gpupdate /force and retry.
Fix 3 — Check Domain Policy and Antivirus
- On domain PCs, the restriction may come from a GPO — contact your administrator.
- Some endpoint security can block logon types; test with it temporarily disabled.
- Re-enable security after testing and add proper exceptions.
Troubleshooting
Problem: secpol.msc is not available.
Solution: It is Pro/Enterprise only. On Home, the policy is usually set by a domain GPO; contact your administrator, or adjust via the registry equivalents.
Problem: Change reverts after restart.
Solution: A domain Group Policy is reapplying the restriction — it must be changed at the GPO level by IT.
Problem: Remote logon still blocked.
Solution: Ensure the account is in "Allow log on through Remote Desktop Services" and not in the matching Deny policy.
Problem: It started after security software install.
Solution: Test with the antivirus/endpoint agent disabled; if that fixes it, add an exception rather than leaving it off.
Conclusion
This error is a logon-rights problem. Add the account to the correct "Allow log on" policy, remove it from any "Deny log on" list, and check domain GPOs — then the sign-in method is permitted again.
</w:pBdr><w:spacing w:before="220" w:after="40"/></w:pPr><w:r><w:rPr><w:b/><w:bCs/><w:color w:val="0B5394"/><w:sz w:val="21"/><w:szCs w:val="21"/><w:rFonts w:ascii="Calibri" w:cs="Calibri" w:eastAsia="Calibri" w:hAnsi="Calibri"/></w:rPr><w:t xml:space="preserve">About TechHub
This guide is part of the TechHub Knowledge Base. For more step-by-step IT guides and support, visit techhub.com.lk.
