Windows XP: users suddenly cannot login

Hi,

I have an interesting (sort of :)) issue at my company.

We have a bunch of XP computers who function as standalones, meaning the users are not logged into the domain but locally on "this computer"

These computers are in various places in our organisation.

One day all of the users who use these systems get the error: Local policy does not allow you to logon interactively
The users have a simple "user account" on these computers

Strange that it worked before perfectly but one day from the other users get this message (nothing that we know of changed on these systems, it's impossible -> nobody uses these systems but simple users who use the system for a application to look up phonenumbers)


My research: on these computers i looked at the local policy settings
there i found the issue: on the policy logon locally the user group is not listed only the Administrators and BackUpoperators

I cannot change this it is grayed out...so i assume these settings were once inherited from the domain they were logged onto. XP obviously works that way that when you logon locally (i used a local Administrator account) these settings still take effect and are not changeable.

My question:
How did this suddenly happen? the day (and many months before these users could logon (various places in the organisation, even locations in other cities) and nothing should have changed.

There's probably a group policy or someone manually removed the account from the local policy for the account you're attempting to logon with.

For the local policy run secpol.msc and check Security Settings -> Local Policies -> User Rights Assignment -> Log on Locally.

Add the account to the list.

Since it is the Admin account logon with a limited account and use Run As to launch the policy console - use the Admin user/pass to open it and fix the issue.

Check if the users are members of other groups that may be members of the restricted group. Use rsop.msc to check the policies that are being applied in the Server.

Such thing cannot happen if the computers were never connected to server. Its surprising.

You're sort of between a rock and hard place. It basically sounds like your user has been removed from the logon locally right. But, if you can access the server remotely you can use the ntrights.exe utility that comes in the 2k Resource kit(probably downloadable from Microsoft.com) to grant your user the right to logon. Reference article 315276 and add the Administrators group to the SeInteractiveLogonRight right.

thanks!
i will use ntrights.exe to fix the access issue for the users, good tip.
how this could have happened is still very odd