Local Security Policy Does Not Enable a User to Locally Log on to System |
Q285548
SYMPTOMS
When you attempt to locally log on to a Microsoft Windows 2000-based computer, you may receive the following error message:
The local policy of this system does not permit you to logon interactively.
Network access, however, to the computer is still available, and the Domain security policy that disables the log on to the local computer is not set.
CAUSE
This behavior can occur because Local security policy has denied local logon rights to everyone.
RESOLUTION
To resolve this behavior, perform the following steps:
- Connect to the problem Windows 2000-based computer's C$ share from another network computer using the administrator account.
- Open the %Systemroot%\Security\Database folder.
- Rename the Secedit.sdb file.
- If the computer has Microsoft Windows 2000 Professional installed, a Secedit.sdb file has to be copied from an operational Windows 2000 Professional-based computer.
- If the computer has Microsoft Windows 2000 Server installed, a Secedit.sdb file has to be copied from an operational Windows 2000 Server-based computer.
- Copy the new Secedit.sdb file to the %Systemroot%\Security\Database.
- Restart the computer. You should now be able to log on locally.
MORE INFORMATION
The preceding method replaces the local security database if the local logon right is disabled only on the local computer.
If required, you need to define any Local Group policies for this computer. The replacement of the Secedit.sdb file can set the Group policy back to the default.
NOTE: The Ntrights.exe program can be used to add the "Log On Locally" right remotely.
For additional information, click the article number below to view the article in the Microsoft Knowledge Base:
Q279664 How to Set Logon User Rights with the Ntrights.exe Utility
Additional query words:
Keywords : kbtool kbSecurity
Issue type : kbprb
Technology :
Last Reviewed: February 23, 2001 |
