No interactive login

[Xsorovan]

Sooo, something happened on my network (I kind of assume it ad something to do with an emplyee having "Network Magic" on their computer) and now I cannot log into my domain controller at all.

The error states that "The Local Policy for this system does not allow you to login interactively". Fine, ok, something messed up. I find MS KB 276590 which points me to ntrights.exe. I remove the deny login locally policy from the domain admins. Nothing, still beeps at me in error. I try adding the feature to domain admins. Nothing, still beeps. I try making a new account with the new user only being in the Admins group. Nothing. I try a normal user. Nothing. I can see the files on the DC via the network, but no login is possible.

I would GREATLY appeciate any further thoughts on this!

 

[stash]

Good lord. You let random people on your DCs?

Check the allow logon locally right.

 

[Woodie]

All your DCs? or just one?

 

[funkbass81]

if its in the default dc policy, its a matter of time before it replicates to all of them, unless he has another policy overrideing the default policy, which i doubt

 

[Xsorovan]

Originally posted by: stash
Good lord. You let random people on your DCs?

What on EARTH are you talking about? What do you take me for? DO you seriously think I would let random people log into my DCs? Come on, if I'm admistrating these things I would hope you would take me for a little more than a complete idiot. Darn it people, assume I know what I'm talking about and don't assume I'm some "n00b" asking a stupid question.

Yes, I know all about Group Policy, and the only people that are allowed onto the DCs are Domain Admins. There is no reason Group Policy should be blocking me out, but it is. And I cann't find an answer to why I can't get on to my server when there isn't a GP to keep me out.

 

[funkbass81]

Originally posted by: Xsorovan

Originally posted by: stash
Good lord. You let random people on your DCs?

What on EARTH are you talking about? What do you take me for? DO you seriously think I would let random people log into my DCs? Come on, if I'm admistrating these things I would hope you would take me for a little more than a complete idiot. Darn it people, assume I know what I'm talking about and don't assume I'm some "n00b" asking a stupid question.

Yes, I know all about Group Policy, and the only people that are allowed onto the DCs are Domain Admins. There is no reason Group Policy should be blocking me out, but it is. And I cann't find an answer to why I can't get on to my server when there isn't a GP to keep me out.

The Local Policy for this system does not allow you to login interactively".

Obviously its set somewhere. check your DC default policy as well as your Domain Default policy for this setting

Windows Settings
Local Policies
User Rights Assignment

Deny Logon Locally & Log On Locally

You might want to check your policies that pertain to terminal services logons too

 

[stash]

Yes, I know all about Group Policy, and the only people that are allowed onto the DCs are Domain Admins

Good, but that setting doesn't change itself. It doesn't just 'mess up'

You might want to check your policies that pertain to terminal services logons too

Yeah, great point. Are you unable to log on to the console, or over RDP, or both?