Where are AD rights stored?

[MauriceN]

I'm having a strange problem I think is AD/policy related. I have all Win2K servers with latest service packs. The services that are using user accounts to start seem to lose their rights to log on as a service after some period of time (between reboots). So I have to reenter the same password in the user info to get the service to start again and I get the "User Account has been granted log on as a service" pop up. I can then start and stop the service for several hours even with rebooting the server several times. The servers in the "computers" folder are not having the problem. The servers in OUs are having the problem. The OUs do not have any blocking going on and I know they are at least getting part of the default domain policy as I just put on a login banner and all servers get that now. A domain user account is being used for the service. If I make a group policy for the OU that has the servers in it with the rights for the user account to log on as a service then it works. The problem is that it should do it from the default domain policy and I shouldn't have to do it for each individual OU. Also, where would the 'log on as a service' right be stored if not in a policy. Thanks in advance for any help.