Solved

Changed security policy for local and domain log on rights but still not working

Posted on 2008-10-16
2
158 Views
Last Modified: 2013-12-04
I am running Server 2003 on 2 machines.  Both are DC's I have given an OU rights to log on locally as well as through terminal services in both the domain security policy and the domain security policy. Still only my admins can log in. The problem is only on the newer DC and not the original. Also, if i try to DCPromo and demote the newer server i get authentication errors even when using the admins account.

Thanks for your help.
0
Comment
Question by:MarcRajs
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 71

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 22738833

The security policy applied to Domain Controllers comes from the Default Domain Controllers Policy, not the Default Domain Policy.

The difference is extremely important. The Default Domain Controllers Policy contains a large number of settings for the DCs that define access to pretty much everything they do. This is part of the reason why it is important that DCs remain in the Domain Controllers OU.

Chris
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Did you know SD-WANs can improve network connectivity? Check out this webinar to learn how an SD-WAN simplified, one-click tool can help you migrate and manage data in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In-place Upgrading Dirsync to Azure AD Connect
Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

724 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question