Need help - (290) related

M4verick

I'm running Enterprise Server 2003 (trial) on the Microsoft Virtual PC.
I can't get any other users to log in unless they're administrator.
I keep getting "The local policy of this system does not permit you to logon interactively."

I don't know why, I've set the domain gp to allow log on locally for domain users and administrators. I also set the specification for "Deny Log on locally" to nothing. I get the same message whether or not they are both specified or undefined.

So far the virtual server is configured as a domain controller and terminal server. I've gone through the trouble of reinstalling on this virtual pc and it's doing the same thing. Am I missing something silly? I had this working before...

astorrs

M4verick wrote:

I've set the domain gp to allow log on locally for domain users and administrators.

You need to do this in the Default Domain Controller Policy GPO (linked to the Domain Controllers AD container) since the server is a DC and that policy is overwriting the changes you made to the Default Domain Policy GPO.

M4verick

Ah...I found it under Domain Controller Security Policy under Administrative Tools...Thank you, working great now!

steve_f

The MS 290 book gets you to make the Domain Users group a member of Print Operators group.

This is to allow "normal users" to log onto the domain controller for the purposes of having a single server no client computer lab.