URGENT help please : only domain admins can log on :( across whole site...

[kennysarmy]

Everyone else gets the error:

 

"the local policy of this system does not allow you to log on interactively"

 

Apparently there was a power cut in the holidays and I've come in to bedlam...

 

Any ideas?

[EduTech]

Check this, although i think it is unlikely to be so as it don't change on its own

 

• Start the Active Directory Users and Computers snap-in.
  
• Right-click the domain and click Properties.
  
• Click Group Policy.
  
• Double-click Default Domain Policy.
  
• Click Computer Configuration, click Windows Settings, and then click Security Settings.
  
• Click Local Policies, click User Rights Assignments, and then click Log on Locally.
  

NOTE: Only the users that are in the list for this user right should have the right to log on locally to domain member computers.

Add Domain Users or Everyone or undefine the policy (which is the default setting).

 

Source: Error Message&#58 The Local Policy of This System Does Not Allow You to Log On Interactively

 

also,

 

http://answers.microsoft.com/en-us/windows/forum/windows_7-security/the-local-policy-of-this-system-does-not-allow-you/23ed877a-1264-440e-915a-455b7c82ef0f

 

James.

Edited April 26, 2011 by EduTech

[Dos_Box]

Hmm. If there was a powercut it may be prudent to shut down the server room and reboot everything in order. From the router, switches then servers in order of roles (DC's first etc.). Yes, there will be complaints as this may take up to half an hour depending on the size of your network, but if server replications have been messed around with it will save time in the long run as at leat you know that all the servers have started in the correct order and you will be able to use the logs better for fault finding. It's better than having no network at all!! Oh, and check the date/time on your servers as well once they come back up.

[sukh]

I would check what James has suggested, also, for any other GPO's that you may have applied at the OU level, i.e if you have a OU for computers/laptops etc...

 

If the issue still remains, get results from gpresult and post here.

 

Sukh

[glennda]

I doubt the gpo would be changed by a powercut - i would do what DOS_BOX has suggested personally.

[EduTech]

I doubt the gpo would be changed by a powercut - i would do what DOS_BOX has suggested personally.

 

I suggested it, because 1) I don't know if someone has been making any changes over the course of the holiday period and 2) if someone has changed it by accident it may not of became apparent until the whole system has gone down and come back up (wrong).

 

I agree with you, that it is unlikely a power cut to change a GPO because that would just be madness and crazy and well anyone who thought that should be... well i won't say - agreed that you should reboot everything i assumed that it may of already done tbh.

 

James.

[kennysarmy]

On to something - thanks

[zag]

Make a new user in a new OU with a new group policy and see if it works.

 

If it does then it may be something to do with a corrupt group policy.

[kennysarmy]

Bl**dy H*ll

 

Issue was caused by an engineer who had been trying to fix our backup solution editing our default domain policy

 

Just got him to reset all the things he changed and we are back to normal.

 

Thanks for all the replies.

 

Time for a coffee.....

[EduTech]

Bl**dy H*ll

 

Issue was caused by an engineer who had been trying to fix our backup solution editing our default domain policy

 

Just got him to reset all the things he changed and we are back to normal.

 

Thanks for all the replies.

 

Time for a coffee.....

 

I imagine then it was something to do with the fact he may of changed the 'allow logon locally' policy and removed 'Domain Users' or/ 'Everyone' group from the list.

 

at least your backup and running!! nice one!

 

Enjoy your Coffee!

 

James.

[Domino]

Bl**dy H*ll

 

Issue was caused by an engineer who had been trying to fix our backup solution editing our default domain policy

 

Just got him to reset all the things he changed and we are back to normal.

 

Thanks for all the replies.

 

Time for a coffee.....

 

:-O

 

I hope you'll be fetching the hammer of re-education then.....

[plexer]

Find that engineer and pin him against the wall, wth was he doing editing your default domain policy?

 

Ben

[Michael]

I agree it is a bit strange they were editing the Default Domain Policy, but there you go, another lesson learnt