Re: Effective Setting Greyed Out and Cannot Invoke Settings in 'Log on locally'

From: Zack Schneeberger (schneebie1_at_hotmail.com)
Date: 09/18/04 

Date: 18 Sep 2004 05:56:47 -0700

Thanks for the fast reply Steve. It is not a DC so I am guessing that
it would not be configured in the Domain Controller Security Policy
but rather the 'Default Domain Policy.' I checked there here is what
I found:
 - Administrator' is the only group given permission in Allow Local
Logon
 - There is nothing is the 'Deny Local Logon' attribute

So since nothing is being denied I should still be able to add users
in my 'Local Security Policy' right? But I am not able to. I have no
idea why.

Zack

"Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message news:<uKK2d.209792$Fg5.22953@attbi_s53>...
> If this is a domain controller it has to be configured in Domain Controller Security
> Policy. You can also use the gpresult support tool on a domain computer to see what
> "computer" configuration GPO's are applied to that computer [not user]. A GPO from
> anywhere other than local could have that policy enabled for computer
> onfiguration. --- Steve
>
>
> "Zack Schneeberger" <schneebie1@hotmail.com> wrote in message
> news:a2aa04c0.0409171054.33b7b5f2@posting.google.com...
> >I have spent 5 hours trying to figure out this problem. We have a
> > server that is part of the Domain and is running Windows 2000 Server.
> > I am trying to modify the 'Log on locally' policy setting.
> >
> > After I click on 'Log on locally', the 'Effective Policy Setting' for
> > the groups that I want to log on locally is greyed out and unchecked.
> > So that leads me to the conclusion that a Domain Level Policy is being
> > pushed down right?! Well wrong! I have scanned 'Domain Security
> > Policy' and the 'Default Domain Policy' and there is no reference to
> > 'Deny Local Logon' to any group which is maybe why the 'Effective
> > Policy Setting' is greyed out and unchecked for certain groups in the
> > 'Log on locally' policy setting.
> >
> > Why is the 'Effective Policy Setting' greyed out and unchecked for
> > groups in my 'Log on locally' policy setting? It apears that that is
> > nothing denying their existance locally.
> >
> > Thanks in Advance,
> > Zack

Relevant Pages

  • Re: Domain
    ... Domain Controller Security Policy has all user rights assignments ... Configuring ipsec policy at the domain level ...
    (microsoft.public.win2000.group_policy)
  • Re: SBS 2003 Lost all the Security Policies.
    ... i didn't use dcgpofix i used another sbs 2003 premium has example and created the policies manually. ... I know that your Default Domain Controller Security Policy or Domain Security Policy it is empty. ... DCGPOFIX.EXE will restore the Default Domain Policy and the Default Domain Controller Policy to original default settings. ...
    (microsoft.public.windows.server.sbs)
  • Re: Domain Security Policy vs Domain Controller Security Policy
    ... Does Domain Controller Security ... > Policy just effect the DCs and Domain Security Policy effect the whole ... > domain which includes the DCs? ...
    (microsoft.public.win2000.security)
  • Re: Domain Security Policy Versus Domain Controller Security Policy
    ... > Domain Security Policy Versus Domain Controller Security Policy. ... means it takes longer to process the settings. ...
    (microsoft.public.win2000.active_directory)
  • Re: W2K Server / XP Pro Clients / Group Policy -- LOCK TASKBAR
    ... make your dns configuration is correct in that domain controllers point ... The policy you are trying to implement is a "user" configuration policy and therefore ... > machines connecting to a Windows 2000 Domain Controller. ...
    (microsoft.public.windowsxp.setup_deployment)