Logon Interactively

I created a new OU and a new user (he'll be an administrative assistant with limited administration) in Active Directory Users and Computers. I want to allow certain administrative priveleges to this user. The only problem is that when I have that user logon locally to the server, I get a message stating "user can't logon interactively". I knew where to change that option in NT 4.0, but I can't figure this out on Windows 2000 Server. Please help.
paloveAsked:
Who is Participating?
 
osxserverConnect With a Mentor Commented:
this option was called user policy rights in windowsNT and accessed via usrmgr.  windows2000 uses MMC snapins to assign user rights and policies.

use the computer management snapin:

start | programs | administrative tools | computer management

expand the system tools branch in the left pane, then expand the following:

group policy\windows settings\security settings\local policies\user rights assignment

double click on the user right you want to grant

click add and select the users/groups.

click ok then done.

click ok to close the user right assignment.

keep in mind, if you are setting this for a domain controller, then dc's are OUs, called domain controllers which have settings for user rights.  those settings will override any settings on the local computer.

to change the group policy object for the dc ou, right click on the ou in active directory users and computer, then select properties and then the group policy tab.

good luck
0
 
Lee W, MVPTechnology and Business Process AdvisorCommented:
The Administrative tools:

Domain Security Policy
Local Security Policy

contain the settings you need to modify.

I wish I could tell you which take priority, but I got this working by making sure both were set to allow it
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.