Local policy does not allow you to logon interactively

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

jslorenz@gmail.com - 22 Nov 2005 17:00 GMT

I am setting up a w2k server that is a domain controller and a term
server. I am getting an error at logon that says that the local policy
does not allow you to logon interactively. I know that the local
policy has to be set to allow local logon for a group that the account
is a member of and that has been done. I have other servers that are
set up the same way and they work. I have a group called terminal
users and grant the right to logon locally to that group. I am using a
few test accounts and they can logon to all of the existing servers,
but not the new one. I have a second server that I am setting up and I
installed TS before running dcpromo. The test accounts have no
problems logging on to the new server that is not a dc. I think it has
something to do with group policy or local policy or even domain
controller policy, but I cannot find the issue. Has anyone seen this
before? Any solutions?

Reply to this Message

Vera Noest [MVP] - 22 Nov 2005 20:30 GMT

I assume that you know that running Terminal Services in
Application Server mode is *not* recommended on a Domain
Controller, for both performance and security reasons?

You will have to modify the Default Domain Controller Security
Policy to allow your users the "Log on Locally" right to your
domain controllers.

246109 - Error Messages Generated When Logging on with Terminal
Services Client
http://support.microsoft.com/?kbid=246109
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

jslorenz@gmail.com wrote on 22 nov 2005 in
microsoft.public.win2000.termserv.clients:

> I am setting up a w2k server that is a domain controller and a
> term server. I am getting an error at logon that says that the
[quoted text clipped - 11 lines]
> domain controller policy, but I cannot find the issue. Has
> anyone seen this before? Any solutions?

Reply to this Message

jslorenz@gmail.com - 23 Nov 2005 15:17 GMT

Thanks Vera. I do know that this is not a recommended practice, but I
can not justify 2 boxes to support a handful of users.

I ended up demoting it, pulling it out of the domain, adding it back to
the domain, and promoting it. It works like a champ now. It must have
had some issues with the domain policy. I used secedit to refresh the
policy, but that didn't do anything for me. Isn't there some tool that
will allow you to dump all of the policies on a machine and reapply
them rather than just refreshing them? I feel like I took the long way
around the barn...

Reply to this Message