Plesk is not available: Logon failure: the user has not been granted the requested logon type at this computer or Error 503. The service is unavailable

Symptoms

• When loading the Plesk URL - https://203.0.113.2:8443/, the following error message is displayed:

  PLESK_ERROR: ERROR: ExceptionUnable to logon user (VPS-2222\Plesk Administrator): (1385) Logon failure: the user has not been granted the requested logon type at this computer.0: common_func.php3:4147 plesk_internal_file_exists(string 'C:\Parallels\Plesk/admin/plib/locales/en-US/messages_en-US.php')1: common_func.php3:4147 plesk_file_exists(string 'C:\Parallels\Plesk/admin/plib/locales/en-US/messages_en-US.php')2: LocaleManager.php:94 LocaleManager::_locale_file_exists(string 'C:\Parallels\Plesk/admin/plib/locales/en-US/messages_en-US.php')3: LocaleManager.php:87 LocaleManager::locale_exists(string 'en-US')4: common_func.php3:2026 locale_exists(string 'en-US')5: class.Session.php:177 Session->Session()6: auth.php3:206

  ---

  Plesk is not accessible with the following error:

  CONFIG_TEXT: HTTP Error 503. The service is unavailable.

• PleskControlPanel application pool permanently goes down with the following errors in Event Viewer:

  CONFIG_TEXT: Application pool PleskControlPanel has been disabled. Windows Process Activation Service (WAS) did not create a worker process to serve the application pool because the application pool identity is invalid.

  ---

  CONFIG_TEXT: The identity of application pool PleskControlPanel is invalid. The user name or password that is specified for the identity may be incorrect, or the user may not have batch logon rights. If the identity is not corrected, the application pool will be disabled when the application pool receives its first request. If batch logon rights are causing the problem, the identity in the IIS configuration store must be changed after rights have been granted before Windows Process Activation Service (WAS) can retry the logon. If the identity remains invalid after the first request for the application pool is processed, the application pool will be disabled. The data field contains the error number.

• Security Audit event with ID 4625 has contents like:

  CONFIG_TEXT: An account failed to log on.Subject:
  Security ID: SYSTEM
  Account Name: SOMENAME$
  Account Domain: SOMEGRP
  Logon ID: 0x3E7Logon
  Type: 4
  Account For Which Logon Failed:
  Security ID: NULL SID
  Account Name: psaadm
  Account Domain: SOMEGRP
  Failure Information:
  Failure Reason: The user has not been granted the requested logon type at this machine.

Cause

The issue is caused by incorrect local policies configuration on Plesk container.

Resolution

1. Connect to the server using RDP.

2. Make sure that "Plesk Administrator" user belongs to "Administrators" group:

   • Hit Win + r on the keyboard, type compmgmt.msc in the Run window, and then press "ENTER".
   • Go to Local Users and Groups > Users > right click on Plesk Administrator > Properties > Member Of.
     If "Plesk Administrator" doesn't belong to "Administrators" group, add it using Add... button and type "Administrators".
     
3. Open Properties for psaadm user and disable the options Account is disabled and Account is locked out if they are enabled.
         

4. Make sure that "Administrators" group is added to "Log on as a batch job":

   • Hit Win + r on the keyboard, type gpedit.msc in the "Run" box, and then press "ENTER".
   • Go to Local Group Policy Editor > Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Log on as a batch job .
     Make sure that "Administrators" group is added, add it if it is required.
     

5. Ensure that "Everyone", "Plesk administrator", "Administrators" groups, psaadm user are not listed in Local Group Policy Editor > Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Deny log on as a batch job .