RE: Administrator Logon failure

From: Frank Brown [MSFT] (fbrown_at_online.microsoft.com)
Date: 04/30/04 

Date: Fri, 30 Apr 2004 11:38:05 GMT

Symptoms:
============
When you logon to the SBS2003 server locally as the built-in administrator
or
member of administrators group, you receive the following error:

   The local policy of this system does not permit you to logon
interactively

However, you have no problem logging on to the server via a Remote Desktop
/
Terminal Server session using the same account.

Cause:
============
The account you use is a member of Domain Power Users or Remote Operators
security
group.

By default in SBS Local Security Policy (secpol.msc), SBS Remote Operators
(a.k.a
Remote Operators) had Deny log on locally enabled. Remote Operators include
Domain
Power Usesrs as the only member by default.

Resolution:
============
Member of administrators do not need to have Domain Power Users or Remote
Operators
rights. Remove these groups from administrator via a TS session.

Regards,

Frank Brown
Microsoft Small Business Server Support

This posting is provided "AS IS" with no warranties, and confers no rights.

Relevant Pages

  • Re: Setting a password on an AD account...
    ... I assume it's running in a restricted account right? ... You don't use SSL to bind, and as this runs from a server which is not a domain member (a ... this one fails when the current user is not an administrator on the DC. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Cant remove user from administrator group
    ... try lusrmgr instead of usrmgr (if I am remembering NT4 correctly) ... where is name of a member local account or is ... Microsoft MVP (Windows Server: Security) ... > ONLY built in groups/users and the administrator password would be blank. ...
    (microsoft.public.windows.server.security)
  • Re: I shot my foot off almost and the Admin cant log into the server locally
    ... server. ... Keep a backup administrator id around. ... > By default the Administrator should be a member of these groups: ... > Administrators, Domain Admins, Domain Users, Enterprise Admins, Group ...
    (microsoft.public.windows.server.sbs)
  • Re: Which permissions does domain administrators have on member se
    ... Domain Admins are members of the local administrators group. ... When I logon via TS to the member server as domain administrator, ...
    (microsoft.public.windows.server.sbs)
  • Re: Small Business Server Migration
    ... The administrator was a member of the Remote Operators ... to continue the SBS installation after installing SP2. ... but I am no longer able to log on to the server at the console. ...
    (microsoft.public.windows.server.sbs)