Cannot change Effective Security

[Carol]

I have two AD domains with mostly Windows 2000 servers
(and a couple of NT4's still floating around). I have
never been able to change Local Security settings on the
W2K servers, in either domain, using the Local Security
Policy applet. At the moment I'm trying to give a domain
group the "Log on locally" right but the effective setting
remains resolutely unticked.

Now before you tell me to check domain policies - I have
never used domain policies, and just to make sure I went
onto the domain controller, looked in the domain policies,
and there's nothing set. I'm also not using group policies
or anything else that would effect the local security.

I used to get around this problem by modifying the local
security using User manager for Domains - that always
worked and the change was then reflected in Effective
Security Settings. But I don't know what I've done with
the version of usrmgr.exe I had that worked on W2k
servers. The newer versions helpfully tell me that they're
not to be used on W2K.

So what's going on? Why can't I chnage my security
settings?

Thanks,

Carol

 

[Steven L Umbach]

For domain controllers you will have to use the Domain Controller Security
Policy. User rights assignments are configured at that level and is the
reason you can not change settings via local policy. --- Steve

 

[Steven L Umbach]

OK. If the there are effective settings in the Local Security Policy, that
means that machine configuration settings are being inherited from
somewhere. You can use the gpresult tool and it can help you determine where
settings are being applied from. Another thing to try is to create an
Organizational Unit for your servers with it's own GPO that has the user
rights assignment configured to your needs and then move those server into
that OU. You would only need to configure that particular user right. All
other settings would be inherited from parent container by default. It may
also be a good idea to run netdiag on one of those server to make sure dns,
secure channel, domain membership, etc is correct.--- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;321709