How to allow user to log on localy on the DC?

[Pav4o]

I have Windows 2000 Server based DC and i want to grant to some users privileges to log on localy?
I follow the steps in the Windows 2000 Server Resource Kit and edit Default Domain Policy object in this way:
+Computer Configuration
-Windows Setting
-Security Settings
-Local Policies
-Users Rights Assignment
-Log on locally ->here i added two groups of users

But when somebody of these groups try to log on locally the server says that they have no permissions to log on locally.
Any ideas?

 

[Jpoandl]

can't logon a DC locally. There is no local computer to log onto. There is no drop down on a DC for the local server during logon... The only way to logon a DC is by logging into the domain. In a sence, the domain is the local logon.

You would have to run DCPROMO to demote the domain controller to a regular server. After this is done, the user should be able to logon locally.


Joseph L. Poandl
MCSE 2000

If your company is in need of experts to examine technical problems/solutions, please check out

http://www.NJCOMPUTERNETWORKS.com

(Sales@njcomputernetworks.com)

 

[shemsher]

Thy the following and it will work with you.
1. Create a group in the domain controller and add the users in that group.

2. Now on the user's computer, open an existing goup on the basis what privilege you wants to provide them and add the group (which you created in the DC) in the local group and let the user logback and its going to work.

Thanks,

Shemsher

 

[GrnEyedLdy]

Pav4o,

"I follow the steps in the Windows 2000 Server Resource Kit and edit Default Domain Policy object in this way:"

You are on the right track but you need to edit the Default DOMAIN CONTROLERS Policy instead of the Default DOMAIN Policy.

Patty

 

[Seaspray0]

GrnEyedLady is right. You must edit the default domain controllers policy because it is the last policy applied that sets the 'log on locally' policy. Remember, policies are applied in order and the last policy applied that specifies a policy setting will overwrite all previous settings (unless no override is set elsewhere)....

Here's the order: local, site, domain, top OU, sub OU.

Domain controllers reside in the domain controller's OU which has the domain controller's policy.

 

[Pav4o]

Thanks a lot for the answers!
I will try them