How to solve "Logon failure: the user has not been granted the requested logon type at this computer." on wsl2 forever

Question

I know that there is a temporary solution to that error described in this Stackoverflow post.

But I am interested in a more deeply solution tackle the problem at its roots. Why? Because everyday in the morning after starting my Pc I want to open my wsl2 to start docker... And there it is Logon failure: the user has not been granted the requested logon type at this computer. This is so annoying to resolve this problem everyday.

The steps I have to take to sort it (everyday!):

1. Get admin rights from IT
2. Run Windows Terminal as administrator
3. Execute cmd Get-Service vmcompute | Restart-Service

This is such a bad user experience and also time consuming and should definitely not be done everyday. I am so tired of this problem.

Answer 1

The problem is probably that you have a Group Policy in your AD-domain that modifies the "Logon as service" privileges.

Ask your IT admin to add "NT VIRTUAL MACHINE\Virtual Machines" (Well known SID S-1-5-83-0) to the Group Policy that modifies this privilege (in my case it was the default domain policy that modified "Logon As Service").

Worth noting is that the IT Admin has to add this special group from a computer/server that has Hyper-V enabled (or WSL2 components installed). Otherwise the special group will not be available for the admin to add to the policy.

More info in the GITHUB WSL issue or my blog post.