zenportafino
asked on
Need to let user logon locally to a server
Do I need to set default domain policy too. Local has him OK to log in but doesn't work.
JRaster
Is this person loging on the computer phyically, or using remote desktop/terminal services or what?
I you go to gpedit.msc > local computer policy > computer configuration > windows settings > security settings > local policies > user rights assignment > check log on locally and deny logon locally. I presume if you don't have a gpo for a site\domain\ou that is denying the person the ability to log on locally you could set this configuration on the server in question, which would provide the user the ability to log on locally to just that server.
ASKER
Russ, if I check both allow and deny won't the deny supercede the allow?
JRaster - We're using remote desktop. I go through this everytime we have someone work on our web server. I don't like giving them local admin rights and no other groups can write to the registry. I want to allow them to log on locally, give them full permissions only to the volume that the web site and read only for everything else. What to do??
JRaster - We're using remote desktop. I go through this everytime we have someone work on our web server. I don't like giving them local admin rights and no other groups can write to the registry. I want to allow them to log on locally, give them full permissions only to the volume that the web site and read only for everything else. What to do??
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
If the user only needs to log on locally to one machine I wouldn't give the use log on locally in the domain controller gpo. Just give him the log on locally right for the local machine policy. If there isn't any deny's anywhere else including the domain I think it would work.