| Event Id | 533 |
| Source | Security |
| Description | "User not allowed to logon at this computer" Generates while a user Acc trying to logon to a computer which is not included in the list of computers the user is allowed to logon. |
| Event Information | According to Microsoft: Cause : The logon attempt failed. The user account used to log on is not permitted to log on from this computer. This restriction is configured on the user's domain account. Resolution 1) Use "Net use username" command in Domain Controller to check the list of workstations configured for that specific user account. 2)In Active Directory Users and Computers under account/logonto next to the logon hours tab will display list of Workstations accessible for each user account. |
| Reference Links | Alternate Event ID in Vista and Windows Server 2008 is 4625. Tracking Logon and Logoff Activity in Windows 2000 (Article) |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.