domain admins cant logon locally to win XP machines

[Yarpen]

Hi Guys

 

Quick question in relation to local logon on XP machines. I support new site so don't know the infrastructure inside out yet hence this cry for help ;-)

 

Problem:

Domain admin accounts cant log in to win XP machines remotely. Yes, domain admins are in remote operators as normal.

 

I have checked GPO and deny local log on is not set. This affects all XP machines but not Win7.

No policies set on domain admin OU besides main GPO, tested all settings in GPO - no cookie ;-(

 

Now, not a huge issue but it drives me mad as I don't know where to turn next. Seen this issue before years back and remember it was fixed by either adding remote operator permissions or checking the GPO settings.

 

Any ideas would be welcome guys!

 

DC: Win2008R"

Domain functional level: 2008

No recent changes software/hardware

[Yarpen]

SOLUTION FOUND! Will post it here in case someone has a similar issue ;-)

Default workstation policy had a "local policies/allow log on through terminal services" setting set to ALL USERS (not domain users) and of course some Muppet forgot to add domain admins to all_users" group...

[MatthewL]

Domain admins should be part of the local administrators group on the computer and providing RDP is enabled there should be no problem.

[Yarpen]

Domain admins should be part of the local administrators group on the computer and providing RDP is enabled there should be no problem.

 

In this scenario there was a GPO set to "all_users" which has overwritten all other settings - domain admins were not part of all_users ;-)

[MatthewL]

Domain Admins automatically gets added to administrators when a machine is joined to the domain, so unless you have a policy over writing that its an odd one.

 

Least you have is resolved just can't quite picture what you describe.