Event ID 4625 – “The user has not been granted the requested logon type at this machine” (Logon Type 3) for SolarWinds Platform service account

In some environments, a SolarWinds Windows/domain service account may generate repeated Windows Security Event ID 4625 on a subset of workstations or servers. The events typically show:

• Failure Reason: The user has not been granted the requested logon type at this machine.

• Logon Type: 3 (network logon)

• Account For Which Logon Failed: SolarWinds service account (domain account)

• Events occurring every 10–20 seconds on a small number of machines, while others are unaffected.

• Affected IPs may be visible only via IPAM / discovery, not added as full monitored nodes.

This behavior indicates that SolarWinds is attempting a network logon using the service account and that the target machine’s user-rights policy does not allow that account to log on over the network.

• SolarWinds is initiating a network logon (Logon Type 3) to the affected workstations using the configured service account (for discovery, WMI, Windows polling, or IPAM-related lookups).

• On those specific machines, local or domain security policy does not grant that account the “Access this computer from the network” right, or it is explicitly listed in “Deny access to this computer from the network.”

• Windows therefore rejects the network logon and logs Event ID 4625 with the message:
  The user has not been granted the requested logon type at this machine.

There are two supported approaches, depending on whether you want SolarWinds to authenticate to the failing nodes or not.

Option 1 – Allow SolarWinds to authenticate (grant required logon right)

Use this if you want proper credential-based polling / discovery on those machines.

1. Update user-rights on affected machines (or via GPO)

   • On one affected machine, run secpol.msc (Local Security Policy) or apply via domain GPO:

     • Go to Local Policies → User Rights Assignment.

     • Add the SolarWinds service account (or a group containing it) to:

       • Access this computer from the network

     • Ensure the account is not present in:

       • Deny access to this computer from the network

2. Apply and verify

   • Force a group policy refresh (gpupdate /force) or wait for normal GPO propagation.

   • Monitor the Security log on the affected workstation:

     • Confirm that new Event ID 4625 entries with this Failure Reason stop appearing.

     • Verify SolarWinds polling/discovery continues to work as expected.

Option 2 – Stop SolarWinds from attempting Windows logons to those machines

Use this if security policy does not allow the service account to have network logon rights on these systems, and you only want basic reachability/IPAM data.

1. Identify SolarWinds jobs using that account against these IPs

   • In SolarWinds, review:

     • IPAM / subnet scans

     • Network Discovery jobs

     • Any Windows / WMI polling, SAM templates, or UDT jobs that might include those IP addresses or subnets.

   • Confirm which of these jobs is using the SolarWinds domain service account.

2. Adjust scope or credentials

   • For the job that targets these IPs:

     • Either exclude the specific 5 workstations / IPs from that scan or discovery scope, or

     • Change the configuration for that subnet/job to use no Windows credentials (e.g., ICMP/DNS/SNMP-only) for those addresses.

3. Verify

   • After updating the job and letting the next polling/discovery cycle run:

     • Confirm on the affected workstations that no new Event ID 4625 entries are generated for the SolarWinds service account with this Failure Reason.