User Access to a DC

[Harrison Midkiff]

Hello:

I have something which has me puzzled. I have a user account which can
access one of my DC's. The user account is not a member of the Domain
Admins group and I have looked through the Domain Controller Security Policy
and can't figure out how he can login to a DC?

Any suggestions...

Harrison

 

[Giorgos]

Hello,

Have you checked whether this user has a local account to the DC?

 

[Giorgos]

Hello,

Have you checked whether this user has a local account to the DC?

 

[Meinolf Weber [MVP-DS]]

Hello Harrison,

Check the policies at the domain controllers OU for:
Computer configuration, windows settings, security settings, local policies,
user rights assignment, "logon locally"

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

 

[Meinolf Weber [MVP-DS]]

Hello Giorgos,

Sorry, but on a DC local accounts are not existing.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

 

[Harrison Midkiff]

Thanks for replying....

I checked the DC GPO policy and nothing unusual. Still a mystery....

Harrison

 

[Giorgos]

Meinolf, that is correct.

Hello Giorgos,

Sorry, but on a DC local accounts are not existing.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and
confers no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

 

[Dhruv raj]

this is possible if this the first dc in your domain and the user account
exhisted
in the DC even before this dc was promoted To DC
as during dcpromo of the first dc the SAM account database in merged into
the NTDS.dit
the second possibility is
you might have the user listed in "allow logon locally " in the local
security policy
of the dc OR the default domain controlelr security policy

 

[Dhruv raj]

this is possible if this the first dc in your domain and the user account
exhisted
in the DC even before this dc was promoted To DC
as during dcpromo of the first dc the SAM account database in merged into
the NTDS.dit
the second possibility is
you might have the user listed in "allow logon locally " in the local
security policy
of the dc OR the default domain controlelr security policy