local policy of this system does not permit you to logon interactively

it occurs locally and rdp connection is fine.
I havent denied any permission, should i not be able to logon locally by default?

Check your local security policy (gpedit.msc), which groups have the log on locally privilege? It seems that Domain Users is not there. However, is there a reason why all domain users should be allowed to log on locally to the server? You should only grant the privilege to users that actually need the right.

Thanks for the reply.
Could you be more specific about where i check the local security policys?

I actually need everyone to be able to login locally on the server, is there not a default profile i can use that should do this?

Run rsop.msc and check

Local policies -> User rights assignment -> Allow log on locally

This will show which policy is effective, change it to correspond with what you want.

> I actually need everyone to be able to login locally on the server, is there not a default profile i can use that should do this?

May I ask why? Yes, this is entirely possible but not enabled by default and not recommended.

Ok so i've had a look at it... so i have the following:
Acc Op, Admin,  Backup Op, mycompanylocal\iusr_mycompany, print op, server op

It does not allow me to edit or add any other profiles as the buttons are greyed out....

i have a default distribution group as mycompanylocal, is this what mycompanylocal\iusr_mycompany is?

Its just that most people who will use it will be local, so i thought it'd be easier just to let everyone logon locally.... probably not the best solution... so whats the best way to allow someone to logon locally?

You do changes to group policies with the Group Policy Management Console, the rsop tool is just to check effective settings. Open GPMC and change the setting in the policy stated in rsop to be the effective one.

The IUSR_ account is used by IIS to handle anonymous http access, it's an internal account and you don't need to worry about it.

You can create a separate group (eg. Server Users or something), grant that group local log on rights and add only the users who require access to that group.

Hi,

I dont understand what to do in the GPMC as I only see is the different SBS policys, can you expand please?

So from what you said I need to create a new group and then add this group to "allow local logon", that right?

That's right. In RSOP when you look at the log on locally right, it will say next to it which is the effective policy where the setting comes from. You need to edit that policy in GPMC and add the new group there.

I don't have an SBS here I could check from, but in Vista the setting is "Allow log on locally" under Computer configuration -> Windows Settings -> Security settings -> Local policies -> User rights assignment. There's 2 columns, Computer setting which is the effective one and Source GPO which is the group policy object you need to edit. The place should be the same or similar in SBS.

i cant really see anything similar... am i in the right place?