Local Admin Account with Deny Logon Locally

[manishdk]

I have been trying to create an account that will allow some of the users to install programs on their Windows XP with Service Pack 2 machine. I just want them to supply its credentials in the Run as box if they run any program or patch installation files. So I have made an account and also created a GPO for the Test OU which added it to the local admins group by setting "Deny Logon Locally" to "Enabled" and then specified the account in the "Logon as a Service" setting. But if I try to install some program using the Run As with this same new accounts crendentials then I get an error message that says "Logon failure: the user has not been granted the requested logon type at this computer." Can anyone tell me if there is some different setting that I have to configure. Thanks

[unidentified]

If it is a local login then whatever you are doing will not work. You can however try to do something else like setting up a login script for this domain user so that if anyone did login with it to a workstation then they would be logged out of the domain immediately. You can try to Limit User Logon Time in a Domain in Windows Server 2003 by referring to the method here - http://support.microsoft.com/kb/816666

[jigu902003]

You can also use My Log On which would be a different alternative method. This will give a limited user to self promote, if he is given the admin password, and reminds them to de-promote after a reasonable time that has been allowed to do whatever thy need. It also avoids the issue of loss of settings inherent in changing account because it usually promotes the user's own account.

[Big Fish]

You can also try to set logon user rights by using the NTRights utility. The below link describes how to set logon user rights by using the NTRights utility. The NTRights utility (Ntrights.exe) is included in the Windows Server 2003 Resource Kit. For information about the Resource Kit, visit the following Microsoft Web site: http://www.microsoft.com/downloads/d...DisplayLang=en