asked on

The local policy of this system does not permit you to logon interactively

I recently upgraded our second server to be an additional Active Directory computer. When I did this all of the user that were in the group Domain Users would get the error message "The local policy of this system does not permit you to logon interactively" when they tried to log into the server through Terminal Services. I know that I could add them to the administrator group and they wouldn't get this message, but I don't want to have to do this.

I have gone into gpedit.msc and for the policy Log On Locally, I have added the group "Domain Users" however, the Effective Settings, has this policy disabled for Domain Users. Where is this effective setting coming from?

Thanks

ASKER CERTIFIED SOLUTION

Luc Franken

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

dovcamp

ASKER

Thanks for the quick response.

This one fixed it...

http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q247/9/89.ASP&NoWebContent=1

Luc Franken

Glad to help you solve your problem.

JamesYong

I changed my Group Policy. Now I cannot even logon into my Domain using the correct user name and password.
I got the following message after I type in administrator as user name . And I use the correct password:

"Local Policy of this system does not permit you to logon interactively"

Is there any way to logon to the Domain and change the Group Policy?

Or do I you to re-install the windows 2000 server starting from scratch?

dovcamp

ASKER

Did you try the solution above:

http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q247/9/89.ASP&NoWebContent=1

crarey

I have three servers that are load balanced. i just added the third server, and I receive the error "Local Policy of this system does not permit you to logon interactively". A domain user can login to the first two servers, but not on the third.

I tried the one the fix above, but a domain user is still unable to login to the third server.

Any ideas?

LostinParadise

I too have the problem, but it is occurring in SBS 2003. I have tried the above solutioni and can get at the way to were it wants me to execute a secedit command. The syntax they are asking for does not exist. Any idea's Can I get away with a simple reboot?

alan_8sg

User May Be Authenticated by Wrong Domain
View products that this article applies to.
Article ID : 227904
Last Review : February 26, 2007
Revision : 3.2
This article was previously published under Q227904
SYMPTOMS
When you log on to a Windows 2000 domain, you may receive either or both of the following error messages: " Logon Denied--The password is incorrect. Please retype your password. Letters in passwords must be typed using the correct case. Make sure that Caps Lock key is not accidentally on.
The Local policy of this system does not permit you to log on interactively.

Back to the top

CAUSE
This behavior can occur if two domain controllers are promoted using Dcpromo.exe with identical domain names, and both domain controllers are installed as the first domain controller for the specified domain.

You cannot reliably configure two separate domains with the same name. Because both domains register with DNS, there is no way to control which name is resolved to the client.
Back to the top

RESOLUTION
Two resolve this issue, use either of the following methods: " Remove one of the domains with the identical name.
" Using Dcpromo.exe, demote all the domain controllers in the second domain, then use Dcpromo.exe to promote these computers to be domain controllers in the original domain.