Users Cannot FTP to a Windows 2000 IIS Server, System Reports 'Access Denied' with Event ID 100

Although members of the Domain Admins group can successfully FTP to a Windows 2000-based Internet Information Services (IIS) server, members of the Domain Users group may be unable to do so. They may receive the following error message:

This behavior can occur because the Users group does not by default have the Log on Locally user right, which is required to connect to resources hosted on an IIS server.

To resolve this issue, modify the Group Policy Object (GPO) for the domain controller to assign the Log on Locally user right to the Users group:

1. Click Start, point to Programs, point to Administrative Tools, and then click Domain Controller Security Policy.
2. Double-click Security Settings, double-click Local Policies, and then click User Rights Assignment.
3. Under Policy, click Log on Locally, and then click Add.
4. Click Browse, locate and click the appropriate group, and then click Add.
5. Click OK in the open dialog boxes to close them and save the new settings.
6. To refresh the group policy, start a command prompt, type the following command and press ENTER, and then press ENTER again when you are prompted:
   
   secedit /refreshpolicy machine_policy /enforce

This behavior is by design.