September 7, 2008 08:59pm pdt

Member Login

Hall of Fame

Yearly

1KCTS 84,434
2toniur 77,996
3Phil_Agc... 63,250
4rpggamer... 59,424
5oBdA 45,082
6tigermatt 40,569
7McKnife 39,048
8martin_b... 35,705
9CoccoBill 34,700
10richrumble 34,634
11snoopfrogg 33,401
12bbao 31,276
13johnb6767 29,442
14LauraEHu... 27,300
15r-k 25,270
16IndiGenus 24,128
17slam69 22,202
18DaveHowe 22,200
19Shift-3 20,500
20RobWill 18,840
21TechSoEasy 17,500
22LeeTutor 17,212
23Jay_Jay70 16,050
24briancassin 15,700
25PowerIT 15,484

	[x] Attachment Details

The local policy of this system does not permit you to logon interactively

Zone: Windows Network Security Questions

Tags: policy, local, permit, does, system

I recently upgraded our second server to be an additional Active Directory computer. When I did this all of the user that were in the group Domain Users would get the error message "The local policy of this system does not permit you to logon interactively" when they tried to log into the server through Terminal Services. I know that I could add them to the administrator group and they wouldn't get this message, but I don't want to have to do this.

I have gone into gpedit.msc and for the policy Log On Locally, I have added the group "Domain Users" however, the Effective Settings, has this policy disabled for Domain Users. Where is this effective setting coming from?

Thanks

Start your free trial to view this solution

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

8.4

Question Stats

Zone: Security

Question Asked By: dovcamp

Solution Provided By: LucF

Participating Experts: 5

Solution Grade: A

Translate:

Loading Advertisement...

Open Discussion

Comment by alan_8sg

User May Be Authenticated by Wrong Domain
View products that this article applies to.
Article ID : 227904
Last Review : February 26, 2007
Revision : 3.2
This article was previously published under Q227904
SYMPTOMS
When you log on to a Windows 2000 domain, you may receive either or both of the following error messages: " Logon Denied--The password is incorrect. Please retype your password. Letters in passwords must be typed using the correct case. Make sure that Caps Lock key is not accidentally on.
The Local policy of this system does not permit you to log on interactively.

Back to the top

CAUSE
This behavior can occur if two domain controllers are promoted using Dcpromo.exe with identical domain names, and both domain controllers are installed as the first domain controller for the specified domain.

You cannot reliably configure two separate domains with the same name. Because both domains register with DNS, there is no way to control which name is resolved to the client.
Back to the top

RESOLUTION
Two resolve this issue, use either of the following methods: " Remove one of the domains with the identical name.
" Using Dcpromo.exe, demote all the domain controllers in the second domain, then use Dcpromo.exe to promote these computers to be domain controllers in the original domain.

20080723-EE-VQP-34