Unable to log on interactively

quackers · 10 Jul 2008 at 17:14

Just a quick question, a server i did a bit of work on today wouldnt let me log on using the keyboard/mouse/monitor, but would over remote desktop/console connection using the administrator account.

I just get the unable to log on interactively message, i didnt set this server up and i've never come across this before.

Any ideas on how to sort this out? I'm tired and a need a beer lol

.walls · 10 Jul 2008 at 17:37

group policy on the box either does not explicity allow you to log on locally - or you (or more likely a group you're a member of) have been explicitly denied that right.

mr.bond · 10 Jul 2008 at 18:15

Is the server a domain controller? If so then a standard user (which I'm assuming your account is) cannot logon locally without being granted the rights to.

If the above fits your scenario then what you're seeing is default behaviour, and design.

oddjob62 · 10 Jul 2008 at 19:06

mr.bond said:
Is the server a domain controller? If so then a standard user (which I'm assuming your account is) cannot logon locally without being granted the rights to.

If the above fits your scenario then what you're seeing is default behaviour, and design.

A standard user shouldn't be able to RDP either though.

.walls · 10 Jul 2008 at 19:35

http://www.google.com/search?hl=un&q=log+on+locally+policy&btnG=Google+s3a|2ch

oddjob62 is correct - you cannot log on to a domain controller either locally or via terrminal services as a domain user by default. In fact, members of the Remote Desktop Users group cannot either. Only members of the domain local group "Administrators" (which Domain/Enterprise Admins are nested in).

Member servers logon rights are Administrators and Remote Desktop Users.

If the policy is not set by GPO, then it is configured in local policy on the machine.

quackers · 10 Jul 2008 at 22:21

Thanks guys, i was trying to log on as the administrator.

I'll have a look through the local policy and see if i can see anything, it was a right pain in the a$$ today lol

quackers · 10 Jul 2008 at 22:31

Interesting, i'm just having a quick look at my test server (no dc installed). I can see the option in:

local security policy->user rights assignments->allow log on locally

but the administrator group has to be in there, do you think it's part of a group policy?

mr.bond · 11 Jul 2008 at 16:59

oddjob62 said:
A standard user shouldn't be able to RDP either though.

I know, he specifies the administrator account over RDP. Not a standard user (if I've read it right).

I took the "me" in the first sentance as a standard user account, and the "administrator" in the second sentance and RDP as he suggests. If it doesn't make sense apologies, it's been a long day.

quackers · 11 Jul 2008 at 23:16

sorry it was a long day for me as well, it was the administrator account i was trying to use to log on via ctrl+alt+delete and the administrator account via remote desktop.

Looking at the server remotely today, it does have a default group policy on the server and the log on interactively part was undefined. I've allowed the administrator group to log in, next time i'm there i'll give it go.

Time for bed, i'm knackered

.walls · 11 Jul 2008 at 23:48

quackers said:
sorry it was a long day for me as well, it was the administrator account i was trying to use to log on via ctrl+alt+delete and the administrator account via remote desktop.

Looking at the server remotely today, it does have a default group policy on the server and the log on interactively part was undefined. I've allowed the administrator group to log in, next time i'm there i'll give it go.

Time for bed, i'm knackered

Also check "Deny log on locally" and group membership of the administrator account.