Boot into Safe Mode with Command Prompt using F8 or a Windows USB to access recovery options. 2. Enable the built-in Administrator account by running "net user administrator /active:yes" in Command Prompt and set a password. 3. Fix permissions on the user profile folder by taking ownership of C:\Users\YourUsername and granting Full Control to Administrators. 4. Ensure the Group Policy Client, RPC, and LSA services are set to Automatic and are running. 5. Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth to repair corrupted system files. 6. Create a new user profile via Settings if the old one is corrupted, then migrate files after adjusting permissions. 7. Check the registry under ProfileList for .bak entries or incorrect ProfileImagePath values, and correct them after backing up the registry. This error is typically resolved by restoring proper access and system integrity, allowing successful logon to complete.

The error "The Group Policy Client service failed the logon. Access is denied." in Windows typically appears during login and can prevent you from accessing your user profile. It’s often related to permission issues, corrupted user profiles, or problems with system services. Here’s how to fix it step by step.

1. Boot into Safe Mode with Command Prompt

Since you can't log in normally, you’ll need access to an admin account or recovery environment:

• Restart the computer and press F8 (or Shift Restart from login screen) to access recovery options.
• Go to Troubleshoot > Advanced Options > Startup Settings > Restart.
• After reboot, press F4 or 5 for Safe Mode with Command Prompt.
• Alternatively, use a Windows installation USB and choose Repair your computer > Troubleshoot > Command Prompt.

2. Enable the Built-in Administrator Account

If you don’t have another admin account, enable the hidden Administrator account:

In Command Prompt, run:

net user administrator /active:yes

Then set a password (optional but recommended):

net user administrator *

Restart the PC and log in as Administrator.

? Once logged in, you can fix the original user account or create a new one.

3. Check and Fix Permissions on User Profile Folder

The issue may be due to incorrect permissions on the user folder.

• Navigate to C:\Users\YourUsername (replace with affected user).
• Right-click the folder → Properties > Security > Advanced.
• Click Change next to the owner name, enter your current admin username, and click Check Names, then OK.
• Check "Replace owner on subcontainers and objects" → Apply.
• Back in Security tab, ensure your user or Administrators group has Full Control.
• Apply changes.

?? If you're not sure, take ownership of the entire C:\Users\ folder to avoid missing nested files.

4. Ensure Critical Services Are Running

The Group Policy Client (gpsvc) service must be running. To verify:

1. Press Win R, type services.msc, and press Enter.
2. Find Group Policy Client.
3. Make sure its Startup type is Automatic and it’s Running.
4. If not, right-click → Start, and set startup to Automatic.

Also check:

• Remote Procedure Call (RPC)
• Local Security Authority (LSA)

These must be running for logon to succeed.

5. Run System File Checker (SFC) and DISM

Corrupted system files can cause this error.

Open Command Prompt as admin and run:

sfc /scannow

After it finishes, run:

DISM /Online /Cleanup-Image /RestoreHealth

Restart after completion.

6. Create a New User Profile

Sometimes the user profile is corrupted beyond repair.

1. Open Settings > Accounts > Family & other users.
2. Click Add someone else to this PC.
3. Create a new local account with Administrator privileges.
4. Log out and log in with the new account.
5. Copy files from the old user folder (C:\Users\OldUser) to the new one.

? Make sure to adjust folder permissions if you can’t access the old profile.

7. Check Group Policy and Registry (Advanced)

If you’re in a domain environment, group policy misconfiguration might be the cause. But on a home PC:

• Open Registry Editor (regedit).
• Navigate to:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

• Look for subkeys that end with .bak or have RefCount = 0.
• If you find a .bak version of your profile, remove the .bak suffix.
• Ensure the correct profile has ProfileImagePath pointing to your user folder.

?? Back up the registry before making changes.

---

Summary

This error is usually fixable by:

• Enabling the admin account via Command Prompt
• Fixing folder permissions and ownership
• Ensuring essential services are running
• Repairing system files
• Creating a new user profile if needed

It’s not complex, but requires careful handling of permissions and system access. Once you regain access, back up your data and monitor for recurring issues.

The above is the detailed content of how to fix 'the group policy client service failed the logon. access is denied' on win. For more information, please follow other related articles on the PHP Chinese website!