SYMPTOM
When you attempt to connect to a Microsoft Windows 2000-based domain controller running Terminal Services, you may receive the following error message:
The local policy of this system does not permit you to logon interactively.
This error message is not generated when the user account you logged on with is a member of the following default groups:
Account Operator
Administrator
Backup Operator
Print Operator
Server Operator
Others based on services on the computer such as TsInternetUse
NOTE: Member servers and stand-alone servers have the users group included in the "Log on Locally" user right. Because of this, they do not prevent logons from non-administrative users.
CAUS
This issue can occur if the Windows 2000-based domain controller running Terminal Services does not have the Users, Authenticated Users, or Everyone global group added to the Group Policy Object for the "Log on Locally" user right.
RESOLUTIO
To work around this issue, modify the Group Policy Object for the domain controller:
Click Start, point to Programs, point to Administrative Tools, and then click Domain Controller Security Policy
Double-click the Security Settings folder, double-click Local Policies, and then click User Rights Assignment
Under the Policy column, click Log on Locally, and then click Add
Click Browse, click the appropriate group, and then click Add
Click OK, click OK, and then click OK
At a command prompt, type secedit /refreshpolicy machine_policy /enforce, press ENTER, and then press ENTER
