Windows Server 2012 R2 – RunAs fails with logon type 2 not granted – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Admins on Windows Server 2012 R2 cannot use RunAs because the target account lacks ‘Allow log on locally’ or has ‘Deny log on locally’ applied, returning logon failure 1385.

Environment & Reproduction

Reproducible from a console session attempting to elevate an admin tool with a different account.

secpol.msc
Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4625)]]" -MaxEvents 20

Root Cause Analysis

Hardened baselines restrict interactive logon to specific groups, denying others by policy.

Quick Triage

Capture failure and check policy.

secedit /export /cfg C:Temppolicy.cfg /areas USER_RIGHTS
Get-Content C:Temppolicy.cfg | Select-String 'SeInteractiveLogonRight','SeDenyInteractiveLogonRight'

Step-by-Step Diagnosis

Identify which policy controls the assignment.

gpresult /h C:Tempgp.html /f
Get-ADGroupMember 'Server Operators'

Solution – Primary Fix

Add the account or group to ‘Allow log on locally’ and reapply policy.

# Modify GPO via gpedit.msc - User Rights Assignment - Allow log on locally - add CORPAdmins
gpupdate /force

Solution – Alternative Approaches

Use ‘Log on as a batch job’ for scheduled scenarios instead of RunAs.

# secpol.msc: User Rights Assignment - Log on as a batch job - add CORPsvc-job
gpupdate /force

Verification & Acceptance Criteria

RunAs prompt succeeds and 4624 logon type 2 events appear.

Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4624)]]" -MaxEvents 5

Rollback Plan

Revert User Rights changes if security policy review rejects them.

# Remove account from Allow log on locally via gpedit.msc
gpupdate /force

Prevention & Hardening

Document interactive logon groups and avoid ad-hoc RunAs on production.

Get-Content C:Temppolicy.cfg | Select-String 'SeInteractiveLogonRight'

Related Errors & Cross-Refs

Linked with JIT admin and Just Enough Administration workflows.

Related tutorial: View the step-by-step tutorial for Windows Server 2012 R2.

View all Windows Server 2012 R2 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn: User Rights Assignment and interactive logon policies.