G
Guest
What will be affected if I enable the "Deny logon locally" to those groups?
Thanks
Thanks
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an alternative browser.
You should upgrade or use an alternative browser.
O
Oli Restorick [MVP]
If you like reinstalling Windows, go ahead. Otherwise, bear in mind that
deny overrides everything, and that by denying everyone the right to log on,
nobody will be able to log on, including adminsitrators or the local PC or
to that domain.
In other words, don't do it!
Oli
deny overrides everything, and that by denying everyone the right to log on,
nobody will be able to log on, including adminsitrators or the local PC or
to that domain.
In other words, don't do it!
Oli
R
Roger Abell
Oli gave you a good pointer, that Deny overrides affirmative grants,
and denying Everyone would mean no account could log in except
over the network.
There is really no reason to use Deny Logon Locally except where
some account do have a grant to Logon Locally due to the groups
given that right. For example, if Users is allowed to login but there
are a couple of account in Users that should not be able to log on.
and denying Everyone would mean no account could log in except
over the network.
There is really no reason to use Deny Logon Locally except where
some account do have a grant to Logon Locally due to the groups
given that right. For example, if Users is allowed to login but there
are a couple of account in Users that should not be able to log on.
S
Steven L Umbach
Roger and Oli explained what will happen. In general try to avoid deny
entries, though there will be cases in where you may want to use it. If a
user does not have an explicit allow then they have an implicit deny. In
your case remove everyone and users from allow logon locally and add
authenticated users. Anonymous for sure and I believe guest built in account
are not members of authenticated users. It would not hurt to add the guest
account to deny logon locally and deny access this computer from the network
assuming you do not want guest access. --- Steve
entries, though there will be cases in where you may want to use it. If a
user does not have an explicit allow then they have an implicit deny. In
your case remove everyone and users from allow logon locally and add
authenticated users. Anonymous for sure and I believe guest built in account
are not members of authenticated users. It would not hurt to add the guest
account to deny logon locally and deny access this computer from the network
assuming you do not want guest access. --- Steve
G
Guest
Thanks Oli, Roger and Steven for your response.
Steven L Umbach said:Roger and Oli explained what will happen. In general try to avoid deny
entries, though there will be cases in where you may want to use it. If a
user does not have an explicit allow then they have an implicit deny. In
your case remove everyone and users from allow logon locally and add
authenticated users. Anonymous for sure and I believe guest built in account
are not members of authenticated users. It would not hurt to add the guest
account to deny logon locally and deny access this computer from the network
assuming you do not want guest access. --- Steve