Error Message: The Local Policy of This System Does Not Allow You to Log On Interactively

When you join a Microsoft Windows 2000 domain, restart your computer, and then log on, you receive the following error message:

This behavior occurs when a domain policy, at the site, domain, or organizational unit, has a configuration that denies all users the Log on Locally user right.

To resolve this issue, check the default domain policy to confirm that the Log on Locally user right, is not defined or is defined to include everyone who is able to log on to domain member computers. To check the default domain policy, follow these steps:

1. Start the Active Directory Users and Computers snap-in.
2. Right-click the domain and click Properties.
3. Click Group Policy.
4. Double-click Default Domain Policy.
5. Click Computer Configuration, click Windows Settings, and then click Security Settings.
6. Click Local Policies, click User Rights Assignments, and then click Log on Locally.
   
   NOTE: Only the users that are in the list for this user right should have the right to log on locally to domain member computers.
7. Add Domain Users or Everyone or undefine the policy (which is the default setting).

A computer joins a domain in the following order of priority:

• Local Security Policy
• Site Policy
• Domain Policy
• Organizational Unit Policy

You are unable to create policies for the organizational unit on the default computer.

You may also need to check the site and organizational unit policies for this same user right.

For more information about group policy, see the Introduction to Windows 2000 Group Policy white paper at the following Microsoft Web site: