The Default Domain Controllers Group Policy object (GPO) contains many default user-rights settings. In some cases, changing the default settings may produce undesirable effects. This may result in a condition where unexpected restrictions exist on the user rights. If the changes are unexpected, or if the changes were not recorded so that it is unknown which changes were made, it may be necessary to reset these user-rights settings to their defaults.
This situation may also result if the contents of the Sysvol folder were manually rebuilt, or restored from backup by using the procedures in the following article in the Microsoft Knowledge Base:
Group Policy Error Message When Appropriate Sysvol Contents Are Missing
It may be also necessary to reset the SeInteractiveLogonRight and SeDenyInteractiveLogonRight user-rights settings to their defaults if you receive the following error message when you try to log on to the console of the domain controller:
The local policy of this system does not permit you to logon interactively
Note The default path for the Sysvol folder is %SystemRoot%\Sysvol
To completely reset the user rights to the default settings, replace the existing information in the GptTmpl.inf file with the following default user-rights information. You can copy, and then paste the appropriate section below into your existing GptTmpl.inf file.
Please note the permissions settings for each template. You should use the correct template for your installation based on your desired user-rights settings.
Note Microsoft strongly recommends backing up the GptTmpl.inf file before making these changes.
Permissions compatible with Pre-Windows 2000 users
Increase the version number to a number large enough to guarantee that normal replication will not make the new version number become outdated before the policy can be reset. It is preferable to increment the number by either adding the number "0" to the end of the version number, or the number "1" to the beginning of the version number.
Save and close the Gpt.ini file.
Apply the new group policy.
Use Secedit to manually refresh the group policy. This can be accomplished by typing the following line at a command prompt:
secedit /refreshpolicy machine_policy /enforce
In Event Viewer, check the Application Log for event number "1704" to verify successful policy propagation.
For more information about refreshing the group policy, click the following article number to view the article in the Microsoft Knowledge Base: