WSUS + Client Login....

[techie]

Have installed WSUS (all seemed ok).

Added all computers into a organisational unit (which i have added the WSUS policy too).

None of the computers are able to login, they all give this error "The Local Policy of This System Does Not Permit You to Logon Interactively" when logging in as a user. I guess that some permissions are incorrect somewhere!


Any pointers?
Thanks,
Andy

[ajbritton]

First of all, try moving one of the computer accounts out of your new OU and back to wherever it came from. Reboot the PC a few times (so that policy gets applied) and test logon as a user. If logon is OK, then it must be to do with the policy applied on the OU. Use Group Policy Management Console (GPMC) RSoP feature to show all the policies that apply to computers in the OU. This should show where the policy is coming from.

IIRC there is a user 'right' called 'log on interactively). I think this would be controlled by a policy under Computer Configuration, Windows Settings, Security, User Rights (or similar).

Hope this helps.

[techie]

I moved the computer out of the OU (back to 'computers') and it logged on fine but my guess is the policy isn't being applied?

The users are under the policy (which includes the WSUS) but i think the actual PCs need to be?

[ajbritton]

You are correct - It is the computer accounts which need the policy applying. Whereabouts did you create the OU (as in what is the OUs parent object)?

I'm guessing that you've ony just started with OUs. If so, there is a thread somewhere on the site relating to suggested OU structure. It might be worth a look to see how other people have structured their OUs.

[techie]

it is an "inherited" setup, plus im only a techie.... NWM has his own thoughts


-default OU (here is the policy)
- Staff
- Computers


I think it should be more like

-default ou (nothing applied)
- Staff (user restriction policy applied)
- Computers (pc restrictions + software installes applied)

I think it should be more like

-default ou (nothing applied)
- Staff (user restriction policy applied)
- Computers (pc restrictions + software installes applied)

Hit the nail on the head.

I have a setup like the above.

-User OU (Global User GPOs)
-------Staff OU (Staff User GPOs)
-------Pupil OU (Pupil User GPOs)

-Computer OU (Global PC GPOs) eg WUSU
-------Room 1 OU
-------Room 2 OU
-------Laptop OU

You get the idea

[Geoff]

However I have my WSUS settings GPO in the default UO. Only because there are user and computer settings. Otherwise I'd need two GPOs to acomplish the same thing and more GPOs = slower machine startup/user login.

The only other thing I do is alter the default domain controller GPO and set WSUS to download and notify rather than download and install like I have everywhere else.