Home > Dynamics CRM 2011 Technical > CRM 2011 unable to change domain logon name “Access denied” Error

CRM 2011 unable to change domain logon name “Access denied” Error

While many of us encounter this error at different occasions when working with Microsoft Dynamics CRM 2011 (On Premise). I’ve seen this error happening at the following situations,

  • When creating a new user (On Premise)
  • Your Workflow suddenly stops firing or sometimes status pending
  • During your plugin execution

The “Workstation” service in your CRM server is not running or stopped.

  • To fix the same, click start –> Run – > type “services.msc” and check if your “Workstation” service is set to automatic and started.

Change Registry setting.

  • Make sure you have the "AutoGroupManagement" value set to 1 (false) in your registry (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRM

Reason behind this registry change?

By default, the Auto Group Management functionality is turned on. Microsoft Dynamics CRM automatically adds the appropriate user accounts and the appropriate computer accounts to the required Microsoft Dynamics CRM security groups. If you turn off Auto Group Management, Microsoft Dynamics CRM does not automatically add these accounts. In this case, a domain administrator or a user who has sufficient permissions must add the appropriate user accounts and the appropriate computer accounts to the required groups.

Happy Troubleshooting!


Francis Edwin

  1. November 27, 2012 at 2:44 am

    Hey There. I found your weblog using msn. That is a really neatly written article. I will make sure to bookmark it and return to learn extra of your helpful info. Thank you for the post. I’ll certainly return.

  2. January 18, 2013 at 9:01 am

    Thank you! Thank you! I have spent several hours today trying to figure out why this was happening for my plugin. (Note: this only started happening after I rebooted my CRM servers).

    Two notes:
    1) The registry key I changed on my system was “AutoGroupManagementOff” (note the “Off” at the end).
    2) I had to restart the CRM services in order for the setting to go into effect.

    • January 18, 2013 at 11:05 am


      I’m glad it helped you!


  3. tang3nt
    January 19, 2013 at 7:38 am

    Better yet:

    -Open computer management console (right-click on computer -> manage), Server Manager, Configuration, Local Users and Groups, Groups and find CRM_WPG.

    -Add the user running your CRM app pool here (network service by default).

    -Reboot server.

    This keeps CRM working as intended, by allowing it to keep the AD groups properly maintained. That’s a much better solution than hacking at the ragistry like an ape! All the “AutoGroupManagementOff” registry setting does is hide this particular error from you. It doesn’t actually “fix” anything.

    I’m surprised that this is perpetuated as a “fix” on nearly every site/blog/forum. Doesn’t anyone out there actually try to understand what the problem is before solving it?


  4. Marcelino
    March 14, 2014 at 9:59 pm

    thanks for help….and by information…

  5. June 24, 2014 at 1:45 am

    I am having the same problem.
    (CRM 2011 on premise, async plugin trying to create a system user)
    I added account x (id of the async crm service) to crm_WPG , but still get the error ,
    Any other ideas?
    Thanks, Peter

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

<span>%d</span> bloggers like this: