How to modify "Allow logon through Terminal Services" globally in Windows 2003 SBS

   Windows SBS 2003 domain controller,
   Windows XP Pro SP2 workstations.

   I don't know how I did this, but I managed to mangle (i.e. change wrongly)  the security group associated with the "Allow logon through Terminal Services" right on all my XP workstations.  It can't be changed at a workstation -- it's grayed out.  Also, its icon is different from the rest of the local rights.  It shows an icon that looks like two computers with a scroll in the foreground.

Since the problem manifest on all workstations, I'm thinking the change was global, done somewhere on the Windows 2003 SBS server.  Problem is, I don't know where I changed it, and I'm not experienced enough yet regarding AD, GPOs, etc., to know where to look.  (Scanning ExpertsExchange hasn't helped, either, since most related answers relate to Windows 2000 Server, which apparently has a different way to edit group policies.)
What I *do* know is poking around in the Server Management program hasn't helped.  So I'm turning to you, the expert.

Where on my Windows SBS 2003 server do I manage the user rights assignment of my workstations' "Allow logon through Terminal Services" right?

500 points to the first correct caller.  Go!  (and thanks!!)
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

farpostConnect With a Mentor Commented:
go to Active Directory Users and Computers snap-in, choose your domain, go to properties,  group policy.
Select your default policy and click to Edit. Then go to Computer configuration, Local policies, User rights assignment, select 'Allow log on  through terminal services' and edit.

JohnAtkinsonAuthor Commented:
Thanks, farpost!
now what if everything is grayed out and you cannot add anyone?
All Courses

From novice to tech pro — start learning today.