logon interactively

[Guest]

I recently received an error that stated user cannot logon interactively. It only occurs for a few users. I resolved the issue by allowing access for the domain\domain users in the domain controller security to logon locally. This doesn't seem right to me because this gives all usrs the ability to logon to the domain, right
I first had to give these rights when 2000 terminal server was on a DC, but that has since moved to a standalone server. Any thoughts

 

[Steven L Umbach]

Configuring that user right for Domain Controller Security Policy only
affects domain controllers or computers in the domain controller container
[only domain controllers by default]. Domain Security Policy would probably
affect most computers other than those in the domain controller container. I
would check the Local Security policy on that TS server for "effective
settings" and make sure there are no groups in the deny logon locally that
should not be there. --- Steve

I recently received an error that stated user cannot logon interactively.

It only occurs for a few users. I resolved the issue by allowing access for
the domain\domain users in the domain controller security to logon locally.
This doesn't seem right to me because this gives all usrs the ability to
logon to the domain, right?

I first had to give these rights when 2000 terminal server was on a DC,

but that has since moved to a standalone server. Any thoughts