STATUS_LOGIN_TIME_RESTRICTION (0xC0000247): Fix Windows Login Time Locks

If you're staring at STATUS_LOGIN_TIME_RESTRICTION (0xC0000247) on the Windows login screen, your account has logon hours configured. Windows is literally telling you: 'It's not your time to log in.' That's it. No corruption, no driver issue, no malware. Someone set the clock on your account and it needs to be changed.

I saw this last December on a client's front-desk machine. The receptionist couldn't log in at 6:45 AM because IT had set her AD account to 7 AM–6 PM months earlier and forgot. She sat in the parking lot for fifteen minutes waiting for the clock to tick over. Ridiculous, but that's how this error works.

Cause 1: Active Directory logon hours on a domain account (most common)

This is it 90% of the time. If you're on a domain-joined PC, an admin (or an overly enthusiastic onboarding template) set the Logon Hours on your AD user object. Once you hit the boundary, every login attempt returns 0xC0000247 until the window opens again.

To check from a machine you can still log into — or from another admin workstation — open PowerShell as an admin and run:

net user yourusername /domain

Look at the 'Logon hours allowed' line. If it says anything other than 'All' you found it.

Now, to clear it and allow 24/7 access:

net user yourusername /time:all /domain

That's it. No reboot needed. Try logging back in — it should work immediately.

If you want to set a specific window instead of all hours, the command format uses day codes (M,T,W,Th,F,Sa,Su) plus a time range. Example for 7 AM to 7 PM weekdays only:

net user yourusername /time:M-F,7am-7pm /domain

You can also do this in the GUI: Active Directory Users and Computers → find the user → Account tab → Logon Hours button. Same result, more clicks.

Cause 2: Local Security Policy logon hours on a standalone PC

Not on a domain? Then the restriction is coming from local policy or a local user account setting. This shows up on kiosks, shared workstations, and small offices that never bothered with a domain in the first place.

Check it here:

1. Hit Win+R, type secpol.msc, hit Enter.
2. Go to Local Policies → Security Options.
3. Look for Network security: Force logoff when logon hours expire. If that's Enabled, anyone hitting the boundary gets kicked instantly.

That setting alone doesn't set the hours, though. For the actual hours on a local account, it's easiest from the command line. Same command as before, just without /domain:

net user yourusername /time:all

Run from an elevated Command Prompt. Confirm with net user yourusername — check the logon hours line shows 'All'.

One gotcha: if the machine has a scheduled task or Group Policy applying hours on every boot, your change gets reverted. Check gpresult /h report.html from an admin prompt to see if a GPO is enforcing it.

Cause 3: Third-party access control or parental software

Less common but I've seen it bite people. Some access management tools — think Net Nanny, K9 Web Protection (RIP), or corporate endpoint suites like Ivanti or ManageEngine's endpoint tools — inject their own time-of-day rules. These don't show up in net user at all. The account looks unrestricted, but the third-party service is intercepting the logon and blocking it.

How to confirm: boot into Safe Mode with Networking. If you can log in there without hitting 0xC0000247, a third-party service is your problem.

To find it:

1. Right-click Start → Event Viewer.
2. Go to Windows Logs → Security.
3. Filter for Event ID 4625 (failed logon) around the time you tried.
4. In the failure reason, look for the process name doing the block.

Once you identify the software, either disable its time restriction in its own config or uninstall it. Don't just kill the service — it'll come back on reboot.

Quick reference

Fastest path: run net user USERNAME /time:all /domain with the right flags. That solves it 9 times out of 10. If it doesn't, you're dealing with Group Policy or third-party interference — and Safe Mode will tell you which one within five minutes.