Networks

Ask something
Question Locked

Local Policy Does Not allow logon Interactively Error message.

0 helpful
19 replies

by nmgonzalez 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Hello everyone, Im hoping that someone out there can help me with a problem that I have with our Windows Server 2003 SP2 machine. I just recently started receiving the error message "Local Policy Does Not allow logon Interactively" when I try to log on locally. This happens to any account, even the Administrator account. I checked both group policy object through gpedit.msc, and local security settings through secpol.msc. Both policies have the Administrator as well as domain admins added as being allowed to log on localy. They are not on the deny access policy. I've tried the NTRight.exe but I get an error message. I've looked for similar problems but cannot find one that relates to mine. Someone please help. Thanks in advanced.

19 replies

by nimmo

Did you take a look at the domain controller security policy?

by nmgonzalez

How do I look and the domain controller security policy?

by nimmo

If you look in the administration tools you will see it.

by absolutely

What is the most recent change applied since the last time this function behaved as expected?

by nmgonzalez

The only change I made to the network was installing logmein.com service on the server so that I can log in remotely. Thats when problems started happening. But I have since then uninstalled the service, but know the problem wont go away.

by nmgonzalez

I've read this article, but it does not apply to Windows Server 2003, only NT.

by nmgonzalez

Yes, Ive looked in the domain controller security policy. The admnistrators group are set up to logon locally. I've even added the everyone group to try it out but still get the same message regardless.

by nmgonzalez

I have a backup of the system state, but that will restore everything including the exchange server. I use Backup exec 11d for backups.

by absolutely

Can you do a differential backup of the effected directories, separate from the system backup? If BackupExec 11d cannot do that ...

by nmgonzalez

I found out that I can do a system state restore, and it should not affect exchange in any way. The system state will restore AD, COM+ class Register Database, ISS, Registry, system files, and SYSVOL. Do you think if I do this stem restore it will fix my problem? If I do this, do I need to prepare for any possible problems after restoration?

by cg it

this is typical behavior for a domain DC.

I assume that your trying to log on to the local machine not domain [you shouldn't be able to anyways. It's not available from the drop down menu].

by nmgonzalez

Yes i cannot logon on the local machine as the Administrator account or any other domain admin account. I can only logon remotely with no problems.

by admin

This problem is actually caused by the administrator account being part of a group that does not have logon locally.
For example, on the one I fixed, the Administrator was added to the pop3 Users group.

The easiest solution is to log in using remote desktop connection and removing the administrator account from all accounts except:
Domain Admins
Administrators
Domain Users
Enterprise Admins
Group policy creator owners
Schema Admins

Any other Groups need to be removed.

IF you can not Remote in, then you have to hack the box.

Down load the files you will need here http://www.petri.co.il/software/srvany.zip

Step 1

Restart Windows 2003 in Directory Service Restore Mode.

Note: At startup, press F8 and choose Directory Service Restore Mode. It disables Active Directory.

When the login screen appears, log on as Local Administrator. You now have full access to the computer resources, but you cannot make any changes to Active Directory.

Step 2

You are now going to install SRVANY. This utility can virtually run any programs as a service. The interesting point is that the program will have SYSTEM privileges (LSA) (as it inherits the SRVANY security descriptor), i.e. it will have full access on the system. That is more than enough to reset a Domain Admin password. You will configure SRVANY to start the command prompt (which will run the 'net user' command).

Copy SRVANY and INSTSRV to a temporary folder, mine is called D:\temp. Copy cmd.exe to this folder too (cmd.exe is the command prompt, usually located at %WINDIR%\System32).
Create a batch file DS9.Bat

Start a command prompt, point to d:\temp (or whatever you call it), and type:

instsrv PassRecovery "d:\temp\srvany.exe"

(change the path to suit your own).

It is now time to configure SRVANY.

Start Regedit, and navigate to

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PassRecovery

Create a new subkey called Parameters and add two new values:

name: Application
type: REG_SZ (string)
value: d:\temp\cmd.exe

name: AppParameters
type: REG_SZ (string)
value: /k d:\temp\DS9.bat

Now open the Services applet (Control Panel\Administrative Tools\Services) and open the PassRecovery property tab. Check the starting mode is set to Automatic.

Go to the Log On tab and enable the option Allow service to interact with the desktop.

Now it gets Tricky.
The DS9.Bat needs to do something to help.
You can try
Net User IaMGod MyPass12 /Add /Domain
Net Group "Domain Admins" IaMGod /Add /Domain
Net Group "Administrators" IaMGod /Add /Domain
Net Group "Domain Users" IaMGod /Add /Domain
Net Group "Enterprise Admins" IaMGod /Add /Domain
Net Group "Group Policy Creator Owners" IaMGod /Add /Domain
Net Group "Schema Admins" IaMGod /Add /Domain

that creates a user IaMGod with the password MyPass12 and then moves them to the appropiate administrator groups.
then restart and wait about a minute.
try to log in as IaMGod

If that fails, go back to DSRM change the ds9.bat to run other commands on the administrator account such as DSMod commands (you can look those up because there are way too many options to us
When you are done, it is important to clean up your mess.
at a command prompt type
net stop passrecovery

then

sc delete passrecovery

then delete your temp directory.

Hope that helps.

by nmgonzalez

I made sure that those were the only accounts associated with the Administrator account, the ones that you have listed. I am able to remotely log in so I was able to check. I am guessing that since I can logon remotely I dont have to perform the steps prescribed above, correct? I do have a system state backup with backup exec 11d. It will restore the AD, COM+ Register Database, ISS, Registry, system files, and SYSVOL. I cannot choose just one of these. I would have to restore all of these sections. Do you think this will solve my problem? Thanks in advanced.

by admin

If you can log in remotely, then the problem is definately a permissions issue.
The easiest fix may be running DCGPOFIX.exe

What that does is resets the group policies back to the state they were at time of install (or promotion with a few exceptions)

If this is a mission critical server, I would recommend that as the quickest "fix" then afterwards, make sure you check all policies.

that is a command line program and I believe it is dcgpofix /target Both

You can also try looking at
GpResult
with that you can see which groups the administrator account is in according to the GPO
You might find that a group is in a forbidden group.

If none of those help, then the restore may be the best solution.

remember to run GPupdate after doing any changes, and then reboot that server before logging in.

One other option to try is to remove all other groups from the Admin account except administrators, domain admins, and schema admins......

by absolutely

Yes!!

You also need separated backups of all Exchange files, which you [b]know[/b] are messed up. Restore the rest of your system, but separately, backup all directories related to Exchange.

This discussion is closed to new replies.