1

I created a batch file to remove "domain\Domain Users" from the Allow Log On Locally local security policy and replace it with "domain\username". This works. This is my script:

First, remove the unwanted group:

C:\ntrights.exe -r SeInteractiveLogonRight -u "domain\domain users"

Second, add the user:

C:\ntrights.exe +r SeInteractiveLogonRight -u "domain\username"

When I test by updating the machine's policy with the command "gpupdate /force", the Allow Log On Locally setting reverts back to default policy and the "domain\Domain users" entry comes back.

I want to remove the "domain\Domain users" entry and not have it return to the default policy, even if gpudpate /force is run.

I have Windows 7.

1

The computer is subject to a domain policy that is configuring the Allow Logon Locally user right. You need to prevent the computer from receiving this policy.

To determine which policy is changing this setting, use the Group Policy Results wizard in the Group Policy management console. It will identify any GPO that is configuring this setting. Your options include:

  1. Disable the policy
  2. Edit the policy's security settings to prevent your target computer from receiving it
  3. Use a WMI filter to exclude the target PC
  4. Move the computer object to an OU not affected by the policy
  5. Create another policy that sets your desired setting and configure it to have a higher precedence than the unwanted policy
  • I don't have priviledges to read/write policies. I was trying discuss with other team (system admistrator). They disagree with my idea. – biiboy Sep 20 '17 at 9:18
  • Then there is nothing you can do. What I've posted in my answer are the correct solutions. – Twisty Impersonator Sep 20 '17 at 11:50
  • can I add in user configuration for 1 pc 1 login ? – biiboy Sep 22 '17 at 9:34
  • @biiboy I don't know what you're asking. – Twisty Impersonator Sep 22 '17 at 12:28
  • Actually, I want to set Single Login. username A can not login on computer B. Username A can login only in computer A. etc. I have discussed with other team but they this agree with this. really need your advice – biiboy Sep 29 '17 at 2:47
0

Domain group policy will take precedence over local policy, your settings are rollback after Domain Group Policy applied. You need to contact corperate IT service team for help.

  • I don't have priviledges to read/write policies. I was trying discuss with other team (system admistrator). They disagree with my idea. – biiboy Sep 20 '17 at 9:18

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.