Unabled to logon interactively after joining a domain

  • Thread starter Thread starter DM
  • Start date Start date
D

DM

Symptom:
An error appears telling you the local security (or
system) policy will not let you logon interactively after
joinging a domain and rebooting.

I've seen this occur on a single Win 2K Pro workstation
when it was joined to a brand new Win 2k3 domain. This
workstation would not let domain accts or local accts
logon whether they were users or administrators. No other
Win 2K Pro workstation on that network had this problem.
Once the workstation was formated and Windows was
reinstalled and joined back to the domain, the problem did
not occur again.

I have this happening now on one Win 2K Pro workstation
that was joined to a brand new Win 2K domain. Just like
before, the computer is effectively completely unuseable.
In addition, another Win 2K Pro workstation is having a
similar problem. Local users and administrators can logon,
domain users can logon, but the domain Administrator can.
The domain Administrator was able to directly after the
computer was joined to the domain, but within a day or so,
it began to receive the same error msg when logging onto
this computer.

BTW, there are several Win XP Pro workstations in the Win
2K domain, and none of them are having the same problem--
which was the case as well with the Win 2k3 domain I saw
this problem in once before.

Any suggestions other than formatting and reinstalling?

DM
(e-mail address removed)
 
I don't know why you are experiencing that - at one time there was a virus
going around exploiting secedit to reset user rights assignments for logon
locally and/or deny logon locally.

Try this. Create an Organizational Unit and a new GPO for it. For that GPO
configure the user right assignment for logon locally to include
administrators and users. Configure deny logon locally to have only the
guest account. Then move the problem computers into that OU. Run secedit
/refreshpolicy machine_policy /enforce on the domain controller. Reboot the
problem computers and see if you can logon. Assuming you can, check the
Local Security Policy on one of those computers looking at those user rights
for logon locally and deny logon locally to see how they differ from the
effective setting which is the setting that is inherited from the OU GPO.
Also see the link below as two other possible solutions, one that reqires
the ntrights utility. --- Steve

http://www.jsiinc.com/SUBG/TIP3300/rh3361.htm
 
Back
Top