How to Fix “An Administrator Has Restricted Sign In” on Windows 11

The “An administrator has restricted sign in” error appears when Windows prevents a user from signing in with a particular account or authentication method. You may encounter this message while logging into Windows, accessing a Remote Desktop session, signing in with Windows Hello, or authenticating with a work or school account. Since the restriction is enforced by security policies, Windows blocks the sign-in attempt even if the account credentials are correct.

This error is commonly caused by Local Security Policy settings, Group Policy restrictions, Microsoft Entra ID (Azure AD) policies, Windows Hello configuration issues, Remote Desktop permissions, account restrictions, or organizational security policies. On work or school devices, the restriction is often intentionally configured by an IT administrator. On personal computers, however, it can result from misconfigured policies, corrupted user profiles, or recent system changes.

Fortunately, you can usually resolve the issue by verifying account permissions, reviewing sign-in policies, repairing your user profile, and updating Windows. In this guide, we’ll walk you through the most effective methods to fix the “An administrator has restricted sign in” error on Windows 11.

How to Fix “An Administrator Has Restricted Sign In” on Windows 11

Before you begin, determine whether you’re using a personal computer or a work or school device. If the computer is managed by your organization, some restrictions may be enforced by your IT administrator and cannot be changed locally. If you’re using your own PC, follow the methods below to identify and resolve the issue.

1. Restart Your Computer

Temporary authentication issues can sometimes prevent Windows from signing you in.

1. Save any open work if possible.
2. Restart your computer.
3. Try signing in again using the same account.

A restart refreshes Windows authentication services and clears temporary glitches.

2. Verify That the Account Is Enabled

A disabled account cannot be used to sign in.

1. Sign in using another administrator account.
2. Open Computer Management.
3. Navigate to Local Users and Groups > Users.
4. Locate the affected account.
5. Ensure the account is enabled.
6. Apply the changes and restart the PC.

If the account is disabled, Windows may display a sign-in restriction message.

3. Check Local Security Policy

Local security policies can restrict interactive sign-ins.

1. Press Windows + R, type secpol.msc, and press Enter.
2. Navigate to:Local Policies > User Rights Assignment
3. Review policies such as:
   • Allow log on locally
   • Deny log on locally
   • Allow log on through Remote Desktop Services
   • Deny log on through Remote Desktop Services
4. Verify that the affected account isn’t denied access.
5. Save the changes and restart your computer.

Incorrect security policies are a common cause of sign-in restrictions.

4. Review Group Policy Settings

Domain or local Group Policies may be preventing sign-in.

1. Press Windows + R, type gpedit.msc, and press Enter.
2. Review relevant sign-in and authentication policies.
3. Restore any recently modified settings if necessary.
4. Run:

gpupdate /force

5. Restart your computer.

Refreshing Group Policy applies any recent configuration changes.

5. Check Windows Hello Configuration

If the error appears while using Windows Hello, the authentication configuration may be corrupted.

1. Open Settings > Accounts > Sign-in options.
2. Remove the existing Windows Hello PIN if possible.
3. Restart your computer.
4. Set up a new PIN.
5. Try signing in again.

Recreating your Windows Hello credentials often resolves authentication issues.

6. Verify Remote Desktop Permissions

If the error occurs during a Remote Desktop connection, confirm that the user has permission to log in remotely.

1. Right-click This PC.
2. Select Properties.
3. Open Remote Desktop settings.
4. Click Select users that can remotely access this PC.
5. Verify that the user is listed.
6. Add the user if necessary.

Users without Remote Desktop permissions may receive sign-in restriction errors.

7. Disconnect and Reconnect Your Work or School Account

Corrupted workplace credentials can interfere with authentication.

1. Open Settings > Accounts > Access work or school.
2. Select the connected account.
3. Click Disconnect.
4. Restart your computer.
5. Reconnect the account.

This refreshes your organization’s authentication configuration.

8. Repair Corrupted System Files

Damaged Windows system files can affect authentication services.

1. Open Command Prompt as Administrator.
2. Run:

sfc /scannow

3. After the scan completes, run:

DISM /Online /Cleanup-Image /RestoreHealth

4. Restart your computer.

These tools repair Windows components responsible for authentication and security.

9. Install the Latest Windows Updates

Authentication issues are sometimes resolved through Windows updates.

1. Open Settings.
2. Go to Windows Update.
3. Click Check for updates.
4. Install all available updates.
5. Restart your computer.

Updated Windows components improve compatibility with Microsoft account and security services.

10. Create a New User Profile

A corrupted Windows user profile can prevent successful sign-in.

1. Sign in using another administrator account.
2. Open Settings > Accounts > Other users.
3. Click Add account.
4. Create a new local or Microsoft account.
5. Sign in with the new account.
6. Check whether the problem persists.

If the new profile works, your original profile may be damaged.

11. Review Microsoft Entra ID or Domain Policies

For organizational devices, authentication restrictions may come from Microsoft Entra ID or Active Directory.

Ask your administrator to verify:

• User account status
• Group membership
• Conditional Access policies
• Device compliance
• Sign-in restrictions
• Assigned roles

Only an administrator can modify organization-wide security policies.

12. Perform an In-Place Repair Upgrade

If the issue affects a personal computer and none of the previous methods resolve it, repair your Windows installation.

1. Download the latest Windows 11 ISO from Microsoft.
2. Mount the ISO.
3. Run setup.exe.
4. Select Keep personal files and apps.
5. Complete the repair installation.

An in-place repair reinstalls Windows while preserving your files, settings, and installed applications.

Conclusion

The “An administrator has restricted sign in” error usually indicates that Windows or your organization’s security policies are preventing a user from authenticating. In most cases, checking Local Security Policy, reviewing Group Policy settings, verifying account permissions, and repairing Windows Hello or user profiles will resolve the issue on personal computers.

If you’re using a work or school device, the restriction is often enforced by Microsoft Entra ID, Active Directory, or organizational security policies, and you’ll need to contact your IT administrator for assistance. Keeping Windows 11 updated and regularly reviewing account permissions and authentication settings can help prevent similar sign-in issues in the future.