Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 261
  • Last Modified:

Need to let user logon locally to a server

Do I need to set default domain policy too. Local has him OK to log in but doesn't work.
0
zenportafino
Asked:
zenportafino
1 Solution
 
JRasterCommented:
Is this person loging on the computer phyically, or using remote desktop/terminal services or what?
0
 
russ_givensCommented:
I you go to gpedit.msc > local computer policy > computer configuration > windows settings > security settings > local policies > user rights assignment > check log on locally and deny logon locally.  I presume if you don't have a gpo for a site\domain\ou that is denying the person the ability to log on locally you could set this configuration on the server in question, which would provide the user the ability to log on locally to just that server.
0
 
zenportafinoAuthor Commented:
Russ, if I check both allow and deny won't the deny supercede the allow?

JRaster - We're using remote desktop.  I go through this everytime we have someone work on our web server.  I don't like giving them local admin rights and no other groups can write to the registry.  I want to allow them to log on locally, give them full permissions only to the volume that the web site and read only for everything else.  What to do??
0
 
infinitydsmCommented:
Hello,

Right what you need to do is open the "Domain Controller Policy" in administrative tool in the control panel. in there if you goto local policies > security setting - there is the option "Log on Locally" you need to add the users which want to log on to the domain controller / server.

Hope this help's

Thanks
0
 
russ_givensCommented:
If the user only needs to log on locally to one machine I wouldn't give the use log on locally in the domain controller gpo.  Just give him the log on locally right for the local machine policy.  If there isn't any deny's anywhere else including the domain I think it would work.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now