Re: Cannot logon locally at the console

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

On Apr 22, 6:19 am, v-mil...@xxxxxxxxxxxxxxxxxxxx (Miles Li [MSFT])
wrote:
Hello Jim,

Thank you for posting here.

According to your description, I understand that:

A user that is a member of the domain admin group and the local
administrators group cannot logon to the SBS server locally.

If I have misunderstood the problem, please don't hesitate to let me know..

Suggestions:
=================
In Windows Small Business Server 2003, the "Deny log on locally" policy
setting is applied to the Remote Operators group in the Default Domain
Controllers Group Policy object. This policy setting also applies to the
Domain Power Users group because the Domain Power Users group is a member
of the Remote Operators group. Because a Deny permission overrides an Allow
permission, this policy setting prevents users from logging on to the SBS
server, even if the "Allow log on locally" policy applies to those same
users.

To resolve this issue, you may try to check how it works if you remove the
Administrator account from the Remote Operators group and the Domain Power
Users group.

You may check KB 841188 for more detailed information:

"The local policy of this system does not permit you to logon
interactively" error message when you try to log on to a computer that is
running Windows Small Business Server 2003 by using an Administrator accounthttp://support.microsoft.com/kb/841188

Hope this helps. Also, if you have any questions or concerns, please do not
hesitate to let me know.

Best regards,

Miles Li
Microsoft Online Newsgroup Support

==================================================================
Please post your EBS related questions to the EBS newsgroup on Connect
website:https://connect.microsoft.com/ebs08/community/discussion/richui/defau...

If you want to use a newsreader other than a web forum to access these
newsgroups,
please refer to the following blog to apply NNTP password and configure a
newsreader:http://msmvps.com/blogs/bradley/archive/2008/11/02/signing-up-for-the...
08-newsgroups.aspx
==================================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
==================================================================

OK, I found that "domain users" is acually a member of "remote
operators". I removed the user from the "domain users" group and he
will test it this afternoon.

Thank you for all the replies.

-Jim
.

Relevant Pages

  • mssbsssr/sbsmonacct causing audit failure
    ... it first checks if the user account sbsmonacct exists, ... It is a member of Domain Users, Enterprise Admins, and by implication Users ... a member of either the Remote Operators group or the Domain Power Users ... This happens because on SBS 2003, the "Deny log on locally" policy ...
    (microsoft.public.windows.server.sbs)
  • Re: Interactive Logon problem on Server
    ... If you checked Gp Policy and you are correct that you have ... have member groups that aren't supposed to be there. ... > Enterprise Admins ... >> Logon Remotely and open the User account for Administrator and be sure ...
    (microsoft.public.windows.server.sbs)
  • Re: Administrator cant logon locally
    ... b-the are a member of a group or a user specified to be DENY for that right. ... Administrator account for membership, ... Controller policy to see what that is set for. ... SBS what the local policy is, and if it's different than the Default Domain ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: I need to allow add remove programs on SBS Server
    ... You could try running RSOP on the ... add the Resultant Set of Policy snap-in. ... >> What happens if you see what security groups the built-in Administrator ... >> account is a member of, and make the new account a member of all of those ...
    (microsoft.public.windows.server.sbs)
  • Re: Power Users Group
    ... Create a GPO based computer startup script that adds e.g. the builtin ... and has administrator rights. ... Restricted Groups enforced with Group Policy is maybe an option: ... How to Configure a Global Group to Be a Member of the Administrators ...
    (microsoft.public.windowsxp.security_admin)