Should I "Deny logon locally" to ANONYMOUS LOGON, Everyone and Gue

[Guest]

What will be affected if I enable the "Deny logon locally" to those groups?
Thanks

 

[Oli Restorick [MVP]]

If you like reinstalling Windows, go ahead. Otherwise, bear in mind that
deny overrides everything, and that by denying everyone the right to log on,
nobody will be able to log on, including adminsitrators or the local PC or
to that domain.

In other words, don't do it!

Oli

 

[Roger Abell]

Oli gave you a good pointer, that Deny overrides affirmative grants,
and denying Everyone would mean no account could log in except
over the network.

There is really no reason to use Deny Logon Locally except where
some account do have a grant to Logon Locally due to the groups
given that right. For example, if Users is allowed to login but there
are a couple of account in Users that should not be able to log on.

 

[Steven L Umbach]

Roger and Oli explained what will happen. In general try to avoid deny
entries, though there will be cases in where you may want to use it. If a
user does not have an explicit allow then they have an implicit deny. In
your case remove everyone and users from allow logon locally and add
authenticated users. Anonymous for sure and I believe guest built in account
are not members of authenticated users. It would not hurt to add the guest
account to deny logon locally and deny access this computer from the network
assuming you do not want guest access. --- Steve

 

[Guest]

Thanks Oli, Roger and Steven for your response.

Roger and Oli explained what will happen. In general try to avoid deny
entries, though there will be cases in where you may want to use it. If a
user does not have an explicit allow then they have an implicit deny. In
your case remove everyone and users from allow logon locally and add
authenticated users. Anonymous for sure and I believe guest built in account
are not members of authenticated users. It would not hurt to add the guest
account to deny logon locally and deny access this computer from the network
assuming you do not want guest access. --- Steve