Endpoint Central Agent Installation Logon Failure Unknown User Name or Bad Password Fix
The server can reach the PC, but the PC refuses the login. That is a credential story, not a network story — and it usually starts with a password somebody changed last month.
✍️ Technical Anshu🪟 Domain and Workgroup⏱️ 10 minute fix
🎥 Watch how the scope and its credential are set up correctly in the video
"Logon failure: unknown user name or bad password" during agent installation means the Endpoint Central server knocked on the client's door and the admin credential saved in the Scope of Management was rejected. The close cousin of this error is "Access is denied" in workgroup setups, where the login works but Windows refuses to give it admin power remotely. Both are fixed on the credential and sharing side — here is the sequence.
Endpoint Central — Agent Installation Status
STORE-PC03Failed — Logon failure: unknown user name or bad password
STORE-PC04Failed — Access is denied
Credential last editedBefore the last password change
Two different remarks, one family of causes — the saved credential and how Windows treats it
1
Refresh the Credential in Scope of Management
This is ManageEngine's own first resolution for this error: the admin credential defined in the scope is simply no longer valid. Domain admin passwords rotate; the console does not know until every push starts failing.
Go to Admin → Scope of Management and open your domain or workgroup entry
Use the Edit Credential option and re-enter the current user name and password
Make sure the account is a member of the Administrators group on the client computers — a plain domain user can log in but cannot install anything
Retry the installation on one test PC before retrying the whole list
2
Prove the Credential by Hand
On the server, open \\TESTPC\admin$ in Explorer and type the exact credential saved in the console
If Windows rejects it here too, the problem is the account itself — reset it, unlock it, or check it is not expired in Active Directory
If it opens here but the push still fails, suspect the workgroup and UAC behaviour in Fixes 3 and 4 instead
3
Workgroup PCs — Turn Off Simple File Sharing Behaviour
In a workgroup there is no domain to vouch for the login. When the client forces network logons to authenticate as Guest (the old "simple file sharing" behaviour), every admin login lands with guest rights and the install dies with Access is denied.
Use one common local administrator account with the same user name and password on every workgroup PC, and save exactly that in the scope credential
Make sure the network sharing security model on the clients is set to the classic model — local users authenticate as themselves, not as Guest
Keep passwords in sync — one PC where the local admin password was changed alone will fail alone, which is your clue
4
Workgroup PCs — Remote UAC Filtering ⭐
Modern Windows applies UAC filtering to remote logons by local accounts: a local administrator other than the built-in Administrator gets a filtered token over the network, so admin shares open read-only or not at all.
The clean answer in a workgroup is to use the built-in Administrator account (enabled, with a strong password) as the scope credential, or join the PCs to a domain
If you must use another local admin account, a domain GPO or a per-PC registry policy for remote UAC token filtering exists — apply it deliberately and document it, because it deliberately relaxes a Windows protection
Re-test with the manual admin share check from Fix 2 after any change
⚠️ Security note: whatever credential you save in the scope can install software on every managed PC. Use a dedicated service account for Endpoint Central, not your personal domain admin login, and change it on a schedule — then remember to update it in the console the same day.
🎥 See the Scope and Credential Done Right
The video walks through defining the scope and pushing agents with a working credential.
Pushes worked last month and all fail today with logon failure. What changed?
Almost certainly the password of the account saved in Scope of Management was changed or expired, or the account got locked by repeated attempts. Update it through Edit Credential, test on one PC, then retry the rest.
Is a domain admin account compulsory for agent installation?
No. The account needs local administrator rights on the target computers, nothing more. A dedicated account that is a local admin on workstations (and not a full domain admin) is the safer and recommended choice.
Why does one workgroup PC fail with access denied while others succeed?
Workgroup PCs drift individually: one different local password, one machine authenticating network users as Guest, or UAC filtering one account differently. Compare that PC's local accounts and sharing settings with a working PC — the difference is the fix.
This guide is based on the Technical Anshu video on Endpoint Central installation • Stuck on a step? Ask in the video comments and you will get a reply 🙏