2003 DC "The local policy of this system does not permit you to logon interactivly."

Posted on 2004-11-18
Last Modified: 2008-01-09
Running a 2003 domain controller. When I try to remote desktop into it I get this error
"The local policy of this system does not permit you to logon interactivly."
Before this error never existed. I had opened up a question here
and tried this suggestion
located here
I made the change
computerconfiguration>Windows-Settings>local policies>assign of userrights>"Allow to logon via Terminalservices"
and now I cannot RD into this DC anymore, even after changing the setting back and rebooting.

Does anyone know why this happened and what I can do to fix the problem?
Question by:DMS-X
    LVL 6

    Expert Comment

    In you group policy check "Logon Locally" and "Deny Logon Locally" under:

    Windows settings>Security Settings>Local Policies>User Rights Assignment

    Could just be a permissions issue.
    LVL 1

    Author Comment

    Thanks for the reply nihlcat.

    Ok I checked both the "logon Locally" and "deny Logon Locally"
    "deny Logon Locally" is not defined and "logon Locally" does not exist.

    I have noticed however that in AD I am missing the Builtin account called "remote desktop users"
    This 2003 domain controller has been introduced into a 2000 DC enviorment. I still have the 2000 server running AD and in controll of the 5 FSMO roles.
    So this might be normal considering the conditions in which the DC was built. Maybe someone might be able to take a look at a 2003 domain controller that has had its AD structure migrated from a 2000 DC.

    LVL 1

    Author Comment

    oops "Allow logon locally" is probably what you meant and not "Logon Locally", my bad.
    Yes it exists and it is set to not defined.
    LVL 9

    Accepted Solution

    you have to allow logon locally, do NOT set this in domain group policy, set it in domain cotroller group policy or just run gpedit.msc.

    for example if you want to allow Andy to terminal into the domain controller, add his name to  "Allow to logon via Terminalservices" and "Allow logon locally"
    LVL 1

    Author Comment

    I will give it a shot on Moday : )
    LVL 1

    Author Comment

    LVL 1

    Author Comment

    Does anyone know what is going on?
    LVL 15

    Assisted Solution

    Local policy does not apply to DC's

    You should check all those settiings in Default Domain Controller Policy.

    There is also no domain level "remote desktop users" policy.

    Better way to check this is to run the RSOP - Resultant Set of Policy. Do this with rsop.msc on the 2003 server.

    This will give a very clear picture of the status on the server, and where said polices are loaded from. It *should* be the Default Domain Controller Policy, but you never know.

    LVL 1

    Author Comment

    >There is also no domain level "remote desktop users" policy.
    Good to know that.

    I managed to get it working by putting the builtin Administrators account in the default domain policy--->computer config.--->windows settings--->local policies--->user rights.....--->allow logon throught terminal services.

    binary_1001010 and harleyjd thanks for your help!

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Threat Intelligence Starter Resources

    Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

    This may not be a text book method to resolve VSS backup issues but it seemed to have worked on few of the Windows 2003 servers we had issues while performing a Volume Shadow Copy backup. If you have issues while performing a shadow copy backup usin…
    Learn about cloud computing and its benefits for small business owners.
    Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…
    Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

    761 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now