the local policy of this system does not permit you to logon interactively

[cbielich]

Ok this has been an on going problem with no fix, I have tried
everything it seems like and nothing, very frustrated to get this
fixed.

I have a win2000 AD server domain with 3 other win2000 server w/no AD,
they are just plain servers. One is a print server only, the AD server
is a file sharing server, another server for file sharing, another
server running backups. 4 server total 1 AD 3 regular.

I have 57 workstations all running win2000 pro. Have been having no
problem with anything EXCEPT this. Randomly I get about 2 to 5 user at
around the same time that cannot connect to the domain anymore getting
this error "the local policy of this system does not permit you to
logon interactively" when reciving this error I cannot login as
administrator or any other account locally or through the network.
Basically I cannot get into the system AT ALL.

I have read all the Microsoft knowledge pages and all of the google
posts and nothing works. I have used ntrights -m \\computer -u user or
group -r SeDenyInteractiveLogonRight and every other command that you
can use. I went down the list, nothing. I have created a new
organizational unit and placed the Computer Account in there and
changed the permissions, and does not work. There have been no changes
to the network and I have not done anything to the server to make this
happen. Basically it just does when it feels like and I cant figure it
out. Some of the account that this happend to range from being 2
months to over a year old. I have never had a problem adding a new
account then receiving this error as well. It seems like only accounts
that are older this happens too.

 

[Steven L Umbach]

I know a while back that there was a virus/worm going around that would use the
secedit command to change the user rights assignments for logon locally/deny logon
locally on computers to lock users out.

Here is something to consider. Configure the logon locally AND deny logon locally
user right assignment for the domain/OU. I would configure the deny logon locally
account to perhaps be the guest account. If that does not help, create a startup
script that uses the secedit command to reconfigure the user rights assignments to
default levels. See KB link below as an example, but do not use it as is, instead
append " /areas user_rights " to the end of the command or come up with your own
custom template to import that may only have those two user rights in it if you do
not use default configuration for user rights assignments. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;EN-US;313222