Select the product you need help with
- Internet Explorer
- Windows Phone
- More products
Domain Controllers Require the "Log on Locally" Group Policy Object for Terminal Services Client Connections
Article ID: 247989 - View products that this article applies to.
This article was previously published under Q247989
NoticeThis article applies to Windows 2000. Support for Windows 2000 ends on July 13, 2010. The Windows 2000 End-of-Support Solution Center
(http://support.microsoft.com/?scid=http%3a%2f%2fsupport.microsoft.com%2fwin2000)is a starting point for planning your migration strategy from Windows 2000. For more information see the Microsoft Support Lifecycle Policy
When you attempt to connect to a Microsoft Windows 2000-based domain controller running Terminal Services, you may receive the following error message:
This error message is not generated when the user account you logged on with is a member of the following default groups:
The local policy of this system does not permit you to logon interactively.
This issue can occur if the Windows 2000-based domain controller running Terminal Services does not have the Users, Authenticated Users, or Everyone global group added to the Group Policy Object for the "Log on Locally" user right.
To work around this issue, modify the Group Policy Object for the domain controller:
The issue described in this article occurs on Windows 2000-based domain controllers running Terminal Services configured to use Application Server mode for user access. Windows 2000-based domain controllers running Terminal Services configured to use Remote Administration mode do not permit user logon, with the exception of two concurrent administrator accounts for server management. When a user attempts to connect to a Windows 2000-based domain controller running Terminal Services configured to use Remote Administration mode, the following error message is generated:
"Log on Locally" is a required user right in Microsoft Windows NT 4.0, Terminal Server Edition and Windows 2000 Terminal Services. This is because the Terminal Services sessions are the user's desktop environment and the user needs the same rights on the Terminal Server computer that he or she has on other workstations.
You do not have access to logon to this Session.
The issue described in this article occurs when the Windows 2000-based computer running Terminal Services is a domain controller, because domain controllers share a common security database. Windows NT 4.0-based domain controllers use the Security Accounts Manager (SAM) database, and Windows 2000-based domain controllers use Active Directory, which is common to all domain controllers. The "Log on Locally" user right is assigned to a group in Windows NT 4.0, and to Group Policy Objects in Windows 2000. In Windows 2000, one domain controller that is given the "Log on Locally" user right shares this user right with all domain controllers in the domain.
For additional information about Terminal Services client connection error messages, click the article numbers below to view the articles in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/246109/EN-US/ )Error Messages Generated When Logging on with Terminal Services
(http://support.microsoft.com/kb/224395/EN-US/ )Error Message: You Do Not Have Access to Logon to This Session
NOTE: The Ntrights.exe utility can be used to add the "Log On Locally" right remotely.
For additional information, click the article number below to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/279664/EN-US/ )How to Set Logon User Rights with the Ntrights.exe Utility