Login Error (4320)

[Anon29103]

Hi,
Does anyone know what this error message means when I tried to log on to a computer that have LMI installed.
 
Error: The operator or administrator has refused the request. (4320)
 
Thanks.

[KGHalbe]

I did a search of the forums and came up with a previous reply I wrote about the same error code.  I have cut and pasted the reply below:
 
Error 4320 is a Windows error code I believe, and it means, as you have said, that the "operator or administrator has refused the request".  Two of the most common reasons that this happens, is that you either typed the wrong name, OR, the wrong password. 
  
Now, I know you are going to say that everything is the same, but is it possible that the caps-lock key was on on one machine and off on the others ?  Or, off on one machine and on on the other ?
 
I would first try to change the capslock key and then type the password.  If that doesn't work, the only other suggestion I have would be to uninstall the software from that machine, and delete it from your LMI account.  Then, click on ADD computer and add the same computer again, making sure the password is in the case that you think it is. 

One other thing I just thought of, which isn't mentioned in my older reply, is that LMI will NOT work on a blank password.  If you system has a blank password (just hit the Enter key, LMI will not accept that.
 
Let me know if any of the above helped.
 
 

[JeremyS.]

A 4320 indicates that the username/password you are trying to log in with IS correct, but does not have administrative rights on that system.  By default, LogMeIn needs an administrative account for login.

Are you on a domain, by any chance?

[KGHalbe]

Just a suggestion . . .
 
Any chance that the documenting department can come up witha  listing of error codes, and what they mean, along with some things to do to attempt to correct the errors ?
 
That is one thing sorely missing fromthe documentation.
 
 
Thanks,
 
KGHalbe
 

[JeremyS.]

I'll pass that one along.

For now though, searching our knowledge base with just the error code number should yield a solution.

[Anon138848]

I know it's been a while since you've last posted here.  But, I AM on a domain and running into this problem.  Obviously I know my user/password is correct, but it must have to do with not being the administrator.  Now... I have access to the administrator's account on the PC, can I do anything to enable me to access this pc through my regular (domain) account?
 
If you can, please email me at keith@call-tek.com.  If not, I'll check these replies.  Any assistance is appreciated.
 
Thanks,
Keith

[joshopkins]

---

JeremyS. wrote:
A 4320 indicates that the username/password you are trying to log in with IS correct, but does not have administrative rights on that system.  By default, LogMeIn needs an administrative account for login.

Are you on a domain, by any chance?

---

I too am having this same issue.  Having to have the end users apart of the administrative group by default is not acceptable.  Especially in a domain situation.

I am evalutating this for use on 5k+ workstations and laptops and 500+ servers.  However this is a show stopper for us.  How to you make the change so LogMeIn will not require the end user to be in the administator group?  Thanks

[joshopkins · Accepted solution]

Here is the fix for all those who are having this problem but have not yet found the answer. 

The Operator or Administrator has refused the request  (4320)

Error 4320 signifies that a non-administrator is trying to log in with a Windows username and password that does not have permission to use LogMeIn. To allow a non-administrator to use LogMeIn, you need to specify access rights for that particular user account.

Once connected to the target computer as an administrator (the computer you want to access remotely):

• If you are using LogMeIn Pro, go to Preferences > Security settings > Access Control
• If you are using LogMeIn IT Reach, go to Security > Access Control.

Please note: To get to the LogMeIn Menu screen or the Dashboard you may have to log in as the Local Administrator to the computer when you open LogMeIn locally and shown the blue authentication screen.

1. Then click on Add > List Users and Groups, and find the user for whom you wish to specify permissions.
2. Edit the permissions on the right side of the page. The options will explain themselves if you move your mouse over the checkboxes.
3. Once a user has been added with at least login rights, they will be able to access the target computer by using the non-administrator username and password.

When you setup users in Access Control, you can give them full control or set specific permissions. If you wish to give them only certain permissions, then you should leave the boxes in the "Configure" section unchecked. That way, the user won't be able to change any LogMeIn settings in Preferences.

I am in a Domain, can I make this easier?

In network environments you may need to setup user access on multiple computers. The Access Control settings are stored in the registry. They can be transferred if they contain only users/groups whose SID are the same within the domain. One such a group is the Builtin/Users, which might fit for their needs. The settings are under HKEY_LOCAL_MACHINE\SOFTWARE\LogMeIn\V5\Permissions. Follow the steps below to export the registry key to other computers:

1. Go to a PC, set up the necessary access control permissions. You can list the available domain users/groups on the page, use those.
2. Export the above registry key from the PC
3. Optionally, set up the same settings on a different PC and check if the registry settings are the same
4. Deploy the exported registry settings to all PC.

[AndyS]

Thank you, joshopkins, for coming back and posting such a thorough solution to the problem.  I'll mark your post as the "accepted" solution and start pointing people to your post.  Thanks again for your valuable contribution.

[bfpower]

From the admin's perspective, another way to make this easier on a domain is to create a group called "LMI Users."  Give that group administrative access to all PCs via a domain-level Group Policy.  This centralizes administration of the policy, rather than requiring a registry change on all systems.

If you already have a "domain admins" or "PC techs" group, you can simply give that group administrative access, again via domain-level policy.