mediumMultiple ChoiceObjective-mapped

SSCP Practice Question: Refer to the exhibit

Exhibit

Event 4625, Microsoft-Windows-Security-Auditing
Account For Which Logon Failed:
    Security ID:        S-1-5-21-123456789-123456789-123456789-1105
    Account Name:       jdoe
    Account Domain:     CORP
Failure Information:
    Failure Reason:     The user has not been granted the requested logon type at this computer.
    Status:             0xC000015B
    Sub Status:         0x0

Refer to the exhibit. A user reports being unable to remote desktop (RDP) into a Windows server. Given the event log, what is the most likely cause?

⚠ Common exam trap

Many candidates assume RDP failures are due to network issues, firewall rules, or account lockouts, when the event log's specific failure reason (logon type denial) directly points to a missing user right assignment.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The user does not have the 'Allow log on through Remote Desktop Services' user right

The event log shows an 'An account failed to log on' event (ID 4625) with a failure reason indicating 'The user has not been granted the requested logon type at this machine.' For Remote Desktop connections, the required logon type is 'Remote Interactive' (logon type 10). This specific error means the user lacks the 'Allow log on through Remote Desktop Services' user right, which is assigned via Local Security Policy or Group Policy. Without this right, the RDP session is denied at the authentication stage, even if the username and password are correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The user does not have the 'Allow log on through Remote Desktop Services' user right
Why this is correct
The failure reason clearly states the logon type is not granted; this user right is required for RDP access.
✗
The user account is locked out
Why it's wrong here
A locked account would show status 0xC0000234, not 0xC000015B.
✗
The server is not a member of the domain
Why it's wrong here
A non-domain server would show a different error, such as 'The computer is not trusted'.
✗
The user's Kerberos ticket has expired
Why it's wrong here
An expired ticket would result in a different failure reason related to credentials or authentication.

Go deeper

SSCP Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question