Windows Forum

Ask something
Discussion Locked

Interactive Logon/Deny

0 helpful
7 replies

by rbobcat

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I sent 2 of my Tech's out to make some changes in the local policy's. Unfortunatlly they put "Everyone" in "Deny Local logon"

I have tried the MS Resource Ntrights.exe but that does not work ..

7 replies

by bfilmfan

If these systems are in a domain, you can override that setting by placing it in a GPO being pushed down by the domain or on the OU where the workstation objects exist.

by rbobcat

Not on Domain, but would work if it was. was looking for a quicker fix, ended up wiping

by sgt_shultz

if that doesn't work you may have to install a parallel installation of win2ksvr and use it to add the everyone group back into the system32 folder?

by beermonster

I'm assuming this is fixed by now but just in case.

When I had a similar problem it was due to a couple of smacktards from IBM who used one of the company servers to perform remote support on internal machines via terminal services. They were getting a bit territorial about anyone else using the server so one of them changed the local policy to deny local logon, assuming that as he was using a ts session he wasn't logging in locally so wouldn't be effected. end result everyone logged out.

What I did was create a script to apply a secedit template to reset security, and copy the template and script to the server. I then connected to the local policy of the server via mmc on another domain machine (obviously as an admin) which allowed me to access a subset of the policy objects (obviously otherwise I would just have reset the offending setting there and then), amongst which was the option to specify a startup script. So i specified my secedit script, rebooted and job done.....

Creating and applying secedit templates is covered in the secedit help files, accessible by typing secedit from the command line.

This discussion is closed to new replies.