DenyLogonSchedule exists and that your logon trigger works properly before putting WITH EXECUTE AS 'sa' FOR LOGON The trigger body is fairl y y simple..