1

I created a batch file to remove "domain\Domain Users" from the Allow Log On Locally local security policy and replace it with "domain\username". This works. This is my script:

First, remove the unwanted group:

C:\ntrights.exe -r SeInteractiveLogonRight -u "domain\domain users"

Second, add the user:

C:\ntrights.exe +r SeInteractiveLogonRight -u "domain\username"

When I test by updating the machine's policy with the command "gpupdate /force", the Allow Log On Locally setting reverts back to default policy and the "domain\Domain users" entry comes back.

I want to remove the "domain\Domain users" entry and not have it return to the default policy, even if gpudpate /force is run.

I have Windows 7.

0

2 Answers 2

1

The computer is subject to a domain policy that is configuring the Allow Logon Locally user right. You need to prevent the computer from receiving this policy.

To determine which policy is changing this setting, use the Group Policy Results wizard in the Group Policy management console. It will identify any GPO that is configuring this setting. Your options include:

  1. Disable the policy
  2. Edit the policy's security settings to prevent your target computer from receiving it
  3. Use a WMI filter to exclude the target PC
  4. Move the computer object to an OU not affected by the policy
  5. Create another policy that sets your desired setting and configure it to have a higher precedence than the unwanted policy
10
  • I don't have priviledges to read/write policies. I was trying discuss with other team (system admistrator). They disagree with my idea.
    – biiboy
    Commented Sep 20, 2017 at 9:18
  • Then there is nothing you can do. What I've posted in my answer are the correct solutions. Commented Sep 20, 2017 at 11:50
  • can I add in user configuration for 1 pc 1 login ?
    – biiboy
    Commented Sep 22, 2017 at 9:34
  • @biiboy I don't know what you're asking. Commented Sep 22, 2017 at 12:28
  • Actually, I want to set Single Login. username A can not login on computer B. Username A can login only in computer A. etc. I have discussed with other team but they this agree with this. really need your advice
    – biiboy
    Commented Sep 29, 2017 at 2:47
0

Domain group policy will take precedence over local policy, your settings are rollback after Domain Group Policy applied. You need to contact corperate IT service team for help.

1
  • I don't have priviledges to read/write policies. I was trying discuss with other team (system admistrator). They disagree with my idea.
    – biiboy
    Commented Sep 20, 2017 at 9:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .