ADCS – Login Failure: The user has not been granted the logon type at this computer

KB ID 0001242 


Post By: Daniel Newton

I was configuring a ADCS (Active Directory Certificate Services) on a DC (Domain Controller) for a client today and wanted to setup web-enrolment. I gave the Certificate Service User permissions to the IIS_USRS Group and everything was going well. Then, this error popped up when assigning the service account in setup.

001 - Logon failiure service account



This can be easily fixed, just follow these instructions and then you will be cooking on gas! (Remember I am on a domain controller)

Go to Active Directory Users and Computers (dsa.msc) Locate the ‘Builtin’ container > then the Administrators group > and add your server account.

Local Admins Group

REALY: Yes, you need the right to ‘Log on Locally’, and remember this is a Domain Controller, try adding that right manually though GPO, its restricted.

So, when you try and authenticate for the Service Account in setup, it will come up with no errors

005 - Logon as Cert Services User

To prove that it’s not all smoke and mirrors, here is the user authenticated,

006 - Certificate Enrollment Services Rights

Related Articles, References, Credits, or External Links


Author: PeteLong

Share This Post On


    • Your most welcome! 🙂

      Post a Reply
  1. You are crazy, adding this to Domain Admins destroys the whole purpose of service accounts with least privileges. This is very bad practise.

    Post a Reply
    • Hi Martin,
      Thanks for the feedback, I had to check this as it was a guest post. The crux of the problem here is, this role is being deployed on a DC, which I would rather not do, but Daniel does specify this. Also the service account does need to be a member of builtin\administrators, and not domain admins. I would rather have the role on a member server and then simply grant ‘log on as a service’ and ‘log on locally’ but the latter is not available on a DC.


      Post a Reply
      • Put the service account into the ‘Server Operators’ group. That group also has log-on-locally permissions on DCs.

        Post a Reply

Submit a Comment

Your email address will not be published. Required fields are marked *