Solved

Unable to Logon Locally using domain Admin account

Posted on 2008-06-17
4
865 Views
Last Modified: 2013-12-05
Hi,
Could someone guide me on this issue. We have a windows 2000 DC and another server running win"K with exchagne server 2K installed on it. When I try to log on to this second server locally using a domain admin account it does not allow me. But when i try to do so using another account which also has domain admin privilliges, it does log me on.
Just wondering what causes this issue?

Please advice.....

Regards,
Naga.
0
Comment
Question by:nvrkakarla
4 Comments
 
LVL 8

Assisted Solution

by:Sinder255248
Sinder255248 earned 100 total points
ID: 21801356
It could be that it's your first account is denied access in the RDP protocol, Administrative Tools -->  Terminal services config -->  Right click RDP -->  Properties --> Permissions Tab.

Or it could be in group policy -->  Comp Config --> Windows settings -->  Security --> Local Policies -->  User rights assignments

Check these policies under the above location:

Allow logon locally
Allow logon through terminal services
Deny logon locally
Deny logon through terminal services
0
 

Author Comment

by:nvrkakarla
ID: 21801436
Hi Sinder,
thanks for your reply.
Just like to add to my question that this first account does allow me to logon using remote desktop, but when i use the same to logon locall on the server, it denies me!

pleae advice...

Regards,
Naga.
0
 
LVL 7

Accepted Solution

by:
ms-pro earned 200 total points
ID: 21802303
To permit users to log on locally to a domain controller
1.
 Open Domain Controller Security Policy.
 
2.
 In the console tree, click User Rights Assignment.
 
3.
 In the details pane, double-click Allow log on locally.
 
4.
 If this security setting has not yet been defined, select the Define these policy settings check box, and click Add User or Group.
 
5.
 In Add user or group, specify the user or group who will be granted permission to log on locally, and then click OK twice.

http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_23460418.html
0
 
LVL 31

Assisted Solution

by:Henrik Johansson
Henrik Johansson earned 200 total points
ID: 21808101
As you can log on through RDP to the Exchange server, it's a problem with the right to logon locally on that computer.
The user rights assignment for allow or deny logging on locally has been defined in the local security policy (gpedit.msc) on the Exchange server or in a GPO linked to the OU-structure containing the Exchange server. If listed as deny, it will override the allow permission.
Run rsop.msc to see what policy is defining the user right. Expand Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment
* Allow log on locally
* Deny log on locally
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question