August 29, 2008 07:01pm pdt

Member Login

Hall of Fame

Yearly

1KCTS 82,634
2toniur 77,996
3Phil_Agc... 63,250
4rpggamer... 51,924
5oBdA 45,082
6tigermatt 37,569
7McKnife 37,348
8martin_b... 35,705
9snoopfrogg 33,401
10richrumble 32,434
11johnb6767 29,442
12CoccoBill 29,400
13bbao 28,776
14LauraEHu... 27,300
15r-k 24,020
16slam69 22,202
17IndiGenus 22,128
18DaveHowe 19,700
19Shift-3 19,000
20RobWill 17,640
21LeeTutor 17,212
22Jay_Jay70 16,050
23TechSoEasy 16,000
24and235... 15,402
25briancassin 14,700

	[x] Attachment Details

"local policy does not allow you to login interactively"

Zone: Windows Network Security Questions

Tags: interactively, allow, policy, local, logon

we're used to RDP'ing into workstations as the currently logged in users and do admin tasks as needed. then logging out and the user logging back in. recently we decided to switch all workstations' user permissions from local admin to user only. as we started doing this we've noticed that now when we attempt to RDP as the user to test any changes we made as an rdp'ed admin, we get the above mentioned error.

we have a domain with a few win2k advanced servers (one being the AD DC) as well as 2 2003 servers. all workstations are xp.

i have looked around a bit and found 2 hints pointing at domain policies so i did make the following changes on the AD server
1.
Active Directory Users and Computers
Right click your Domain (usually my-company.prv format)
Slide down to and chose Properties
Click the third tab "Group Policy"
Click the Default Domain Policy and hit "Edit" from the buttons below.
Go to Computer Configuration/Windows Settings/Security Settings/User Rights Assingments/ and add "Domain Users" and "Domain Admins" (We added user and administrator to blank list), and any other group that needs to logon locally, which will enable those groups to logon.
2.
Administrative Tools>Domain Controller Security Policy>Security Settings>Local Policies>User Rights Assignment>Policy>Log on Locally>Add>Browse, click the appropriate group, and then click Add. (added users to existing list)

unfortunately we still get the same error on the workstation when trying to RDP into them as a user after the previous rdp session was an admin

any further help or pointing in the proper direction would be greatly appreciated.

Start your free trial to view this solution

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

5.8

Question Stats

Zone: Security

Question Asked By: daya88

Solution Provided By: msice

Participating Experts: 3

Solution Grade: A

Translate:

Loading Advertisement...

Open Discussion

Comment by rkinning

Windows 2003
On a new install of Windows 2003 AD controller the Domain Controller Security Settings needed to be changed. Here is what I did.

Start Domain Controller Security Settings
Open User Rights Assignment
Open Allow Login Locally
Add 'Domain Users' and 'Authenticated Users' groups
Do the same for 'Access this computer from the network'

After this was set I was able to login with a user account.

Hope this helps.

20080723-EE-VQP-34