1

I created a batch file to remove "domain\Domain Users" from the Allow Log On Locally local security policy and replace it with "domain\username". This works. This is my script:

First, remove the unwanted group:

C:\ntrights.exe -r SeInteractiveLogonRight -u "domain\domain users"

Second, add the user:

C:\ntrights.exe +r SeInteractiveLogonRight -u "domain\username"

When I test by updating the machine's policy with the command "gpupdate /force", the Allow Log On Locally setting reverts back to default policy and the "domain\Domain users" entry comes back.

I want to remove the "domain\Domain users" entry and not have it return to the default policy, even if gpudpate /force is run.

I have Windows 7.

I say Reinstate Monica
  • 26,651
biiboy
  • 13

2 Answers2

1

The computer is subject to a domain policy that is configuring the Allow Logon Locally user right. You need to prevent the computer from receiving this policy.

To determine which policy is changing this setting, use the Group Policy Results wizard in the Group Policy management console. It will identify any GPO that is configuring this setting. Your options include:

  1. Disable the policy
  2. Edit the policy's security settings to prevent your target computer from receiving it
  3. Use a WMI filter to exclude the target PC
  4. Move the computer object to an OU not affected by the policy
  5. Create another policy that sets your desired setting and configure it to have a higher precedence than the unwanted policy
I say Reinstate Monica
  • 26,651
0

Domain group policy will take precedence over local policy, your settings are rollback after Domain Group Policy applied. You need to contact corperate IT service team for help.

yanqian
  • 41
  • 4