the "log on interactively" message

Check this artickle;

MS KB Article ID: Q276590

Are you sure that you are not selecting the option to deny everyone the logon locally right (have to be sure)
Also do it without explicitly giving the veryone locally right. It will work without telling w2k that.

Leopold

Check this artickle;

MS KB Article ID: Q276590

Are you sure that you are not selecting the option to deny everyone the logon locally right (have to be sure)
Also do it without explicitly giving the veryone locally right. It will work without telling w2k that.

Leopold

Hi,
As you said when you add you workstation to the domain you can log in..

Do have any other workstation that are members of domain and can they log in.

If not.

Check to see if your domain controller security has a policy configured "deny access locally"". if it has the policy, remove that users account from the policy and go to the log on local and add the group account in that policy on the domain controller.

IF that doesn't work

Create a new GPO on the Domain and ((frist try without importing any sec policy))if it didn't work, import any new sec. policy for your domain and go the "log on Locally policy" and add the group account in there.

Going by the quote from the introduction to this problem: "User access, even though explicitly granted in one case, can be affected by previous overlapping security settings". And, by what joegrosskopf is trying to do: "granting ?everyone? local logon rights to the workstation" and then adding the computer to the domain.

The possible solution may be (this is my stab in the dark as per what I remember in my training as far as PDC's go):
Add the workstation to the PDC "before" you "allow everyone" local logon rights. For you see, the problem may be occurring with the fact that "rights" propagate from the PDC to all computers "added" to the domain which in effect will cancel out any "user rights" assignments based on inheriting rights from the PDC as opposed to what you may be trying to establish on the individual workstation "before" adding it to the PDC's list of "allowed" workstations on that domain. In summary, big brother PDC doesn't want to let little brother workstation take precedence over what he (big brother PDC) say's goes as far as what will be allowed for users to perform on the "domain". I may be wrong in this assumption and please anyone correct me if I'm wrong.

Check your "Domain Security Policy" on the server.(if it is Win2k Svr)
On the workstation's local security policies you will see "local policies" and "effective policies". The effective policies will override any changes you've made to the "local"policies.
To make changes to the polocies go on the server and change them accordingly.

Here's the answer to your problem:
The major cause of this error is the security policy for the domain or the domain controllers. To look at these policies, right click on your domain in AD users and computers (domainname.com) or domian controllers in AD users and computers and select properties. From this window select the group policy tab and the default group policy for the domain or the domain controlers, based on where your at, will show in the window. Click on the default policy once and select the edit button. From here you want to concontrate on the user configuration section and look first at the administrative templates section. You will probably find that the power users group was not deleted when the server had AD installed on it. This group needs to be removed where ever you find it as it is only a local group, not a domain group. Also, look through the settings for anything that does not look right.
After you have looked at these areas there's one last place to dig around in. That's the local security settings. This may well be the culprit. Open Local security policy (start, programs, administrative tools, local security policy). Double click on local policies in the list under security settings. Double click on user rights assignment and look at who is allowed and denied "access this computer from the network". Again, if power users shows up here delete it. After checking all the settings here you should be good to go. If you have more than one DC you will want to replicate to all others and allow up to 15 minutes to pass before going to the local workstation. At the workstation you will want to log on as the local admin and remove any network user profile. After deleting any network user profile on the workstation log on as a user at the workstation and you should go right in. Good luck and happy hunting.

Keith