Re: URGENT - Cannot log on locally

From: Alex Balcanquall [MS] (alexbal@microsoft.com)
Date: 02/06/03 

From: "Alex Balcanquall [MS]" <alexbal@microsoft.com>
Date: Thu, 6 Feb 2003 17:12:21 -0000

FYI Effective permission shows the effective permission of the combination
of the local machine policy and all group policies that apply.

If the deny logon locally also appears in the local setting then you may be
able to edit locally as you describe; however if it only appears in the
effective setting column they you will need to check all Active Directory
based group policies that apply to the DC in question - the Default Domain
or Default Domain Controller are most likely if you have only the 'out of
the box' policies.

Hope that helps.

alex 

--
----
This posting is provided "AS IS" with no warranties, and confers no rights.
"Scott Wilhelm" <swilhelm@sllboces.org> wrote in message
news:ub8rlRTzCHA.2184@TK2MSFTNGP09...
> I recently setup Terminal Services on a server (PDC) for myself & the
other
> network admin here.  Since then, she cannot log onto the service using the
> TS client using her network account (she can with the admin account
though).
>
> After some research, I found that this was due to something in the
policies.
> I found her account under local policies (Local Policies -> User Rights
> Assigned) listed under "Deny logon locally".  I tried to remove it but her
> account was set under effective settings, which I couldn't remove.
>
> So after further research I found that it should be able to be removed
from
> there using NTRights.  Using this line --  ntrights -m \\SERVER -u
> HVCS\Account -r SeDenyInteractiveLogonRight  -- I tried to remove her
> account, but couldn't.
>
> Can anyone give me an idea how I might be able to fix this?  It's really
> starting to get frustrating.
>
> TIA!
>
> Scott
>
>

Relevant Pages

  • Re: Password Policy for remote users
    ... Setting the "password never expires" flag will stop the password from ... to enforce multiple policies and assign them to users, groups, and OUs. ... accounts, and this or the highest priority GPO setting account policies ...
    (microsoft.public.security)
  • Re: Custom Shell and Account Switching
    ... >>>I use local policies for limiting the user environment. ... >>>if I will launch the explorer without logging-off I will still have the policies effect. ... >>>the Techinician can enter the Settings Menu through a small "Settings" button which is secured by a password so that the user ... How policies of your user account can affect Explorer that is launched under Admin account? ...
    (microsoft.public.windowsxp.embedded)
  • Re: GPO configuration
    ... > account/password policy undefined and apply different OU ... > the domain level override OU level? ... I thought the lower GPO policies ... All domain controllers will get their Account ...
    (microsoft.public.cert.exam.mcse)
  • Re: Filter GPO by group
    ... It's true that the accounts policies only can be defined within athe GPO at ... account policy, if you need diffrent policies for diffrent users, write your ... > Technet recommends to not alter the default Domain policy, ...
    (microsoft.public.windows.server.active_directory)
  • Re: log on locally - domain trusts
    ... by NT4 domain controller, and vice versa. ... manipulate policies on NT4. ... > Authority/Authenticated Users account and Interactive account from the ... > Technology Manager ...
    (microsoft.public.windowsxp.security_admin)