How to verify why user group membership is failing

  • Thread starter Thread starter Marlon Brown
  • Start date Start date
M

Marlon Brown

User1 is a member of a AccessServerGroup and attempts to logon to an
application server and is getting message 'your account does not permit you
to logon interactively'. User1 used to be able to logon to that server
accordingly few months ago.

Then I make a copy of of "User1" account. I attempt to login to the same
server and that's successful.

I attempted to remove/readd User1 to AccessServerGroup, but that didn't fix
the problem.

How can I troubleshoot this and see if User1 is getting the group membership
accordingly from AccessServerGroup ? Any tool that let me see on the
respective servers who is actually getting the group membership from
AccessServerGroup. Logged on as a domain admin on the respective Application
server,
I do a

net group "AccessServerGroup"

and User1 is listed as a member of the AccessServerGroup.

Please let me know.
 
Marlon Brown said:
User1 is a member of a AccessServerGroup and attempts to logon to an
application server and is getting message 'your account does not permit you
to logon interactively'. User1 used to be able to logon to that server
accordingly few months ago.

Then I make a copy of of "User1" account. I attempt to login to the same
server and that's successful.

I attempted to remove/readd User1 to AccessServerGroup, but that didn't fix
the problem.
Click to expand...

The User would have to LOGON (anew) for such changes to take
effect.
How can I troubleshoot this and see if User1 is getting the group membership
accordingly from AccessServerGroup ?
Click to expand...

Logon him on and use something like "ShowGrps" or "IfMember" from the Reskit
(much of the Reskit can be downloaded from MS website) to get the actual,
current list.

Any tool that let me see on the
respective servers who is actually getting the group membership from
AccessServerGroup. Logged on as a domain admin on the respective Application
server,
I do a

net group "AccessServerGroup"

and User1 is listed as a member of the AccessServerGroup.
Click to expand...
 
On top of Herb's suggestion, there's also whoami /groups if you're running
XP, or if there's an XP box you can copy it from...

--

Paul Williams

http://www.msresource.net
http://forums.msresource.net
______________________________________
Marlon Brown said:
User1 is a member of a AccessServerGroup and attempts to logon to an
application server and is getting message 'your account does not permit you
to logon interactively'. User1 used to be able to logon to that server
accordingly few months ago.

Then I make a copy of of "User1" account. I attempt to login to the same
server and that's successful.

I attempted to remove/readd User1 to AccessServerGroup, but that didn't fix
the problem.
Click to expand...

The User would have to LOGON (anew) for such changes to take
effect.
How can I troubleshoot this and see if User1 is getting the group membership
accordingly from AccessServerGroup ?
Click to expand...

Logon him on and use something like "ShowGrps" or "IfMember" from the Reskit
(much of the Reskit can be downloaded from MS website) to get the actual,
current list.

Any tool that let me see on the
respective servers who is actually getting the group membership from
AccessServerGroup. Logged on as a domain admin on the respective Application
server,
I do a

net group "AccessServerGroup"

and User1 is listed as a member of the AccessServerGroup.
Click to expand...
 
This error "'your account does not permit you
to logon interactively'" is very similiar to the error you get when you do
not have the user right "allow logon locally"
Or if logging on through terminal services "allow logon through terminal
services" user right.
Is this application server a Citrix server?

Since you made a copy of the account, that copy would have all the same
domain group memberships as the original, and yet it could logon.

This makes me think of 2 possibilities...al-be-it long shots
User1 was specifically added to the "deny logon locally" user right
User1 is a member of the local server guests group.

If this is a citrix server, then perhaps that error is Citrix specific.
 
It is a Citrix server.
The Local\Users group has rights to logon locally.
MyDomain\Domain Users is a member of the local Users group. User1 is a
member of Domain Users.
Terminal Services let "everyone" logon as I guest. I've created a tririval
domain user account and I was able to logon via TS to the Server just fine.

I thought about the 'deny logon locally' right, but that setting was blank;
nobody is denied access there.

Since I am logging on directly via TS, I can't understand how Citrix can be
playing a role on this... but apparently that is what is happening...
 
Back
Top