Domain users not able to logon

Question

We have installed server 2008 r2 and made it a Domain Controller. There are 15 client machines that are connected to the domain. In the past month all domain user logons where working fine. Unfortunately since yesterday we are not able to logon to the domain with any user except the administrator logon. when we trying to logon with any user on the domain it says:

"You cannot log on because the logon method you are using is not allowed on this computer"

Answer 1

Have you made any changes to group policy, recently? It's possible a mistaken change is blocking interactive logins on domain member computers or by users in a certain group or OU. GPO is the most likely explanation, since it's seems to have affected all users at the same time, but not Domain Admins.

Also check the settings on the individual user accounts; examine the 'Logon Hours' and 'Log On To' settings. Perhaps some script has placed the wrong restrictions on the accounts.

Answer 2

Check the time between the client and server. They should be within 15 minutes of each other for Kerberos to function properly. I also support the group policy idea mentioned by SmallClanger. It sounds liked the Domain Users group was denied log on access.

Answer 3

When it works for Administrator and noone else, check the event logs. If they fill up they don't allow local logins. Haven't seen this happen at the domain level, but is worth checking.

Answer 4

When I encounter an error like that, I just put the entire string into google.

There are lots of results coming back. Most seem to point to group policy. One indicates that the users might have been removed from a group or the policy doesn't allow log on locally.

Here are some of the google results: For more, google it yourself. http://www.chicagotech.net/troubleshooting/cannotlogon.htm

http://www.tech-archive.net/Archive/Windows/microsoft.public.windows.server.active_directory/2009-07/msg00509.html

http://forums.techarena.in/active-directory/1188850.htm

Answer 5

Read this document for are the cases due to which the issue raised:

http://social.technet.microsoft.com/Forums/en/w7itpronetworking/thread/0f750de8-d56e-4951-a2b1-839e55934745

Answer 6

One of the reason is maybe you have second DHCP server on some ruters or gateway . Stop all DHCP server on another machines or gateways

Answer 7

I had a problem on a server 2008 machine that wasn't the DC that wouldn't let any non-local users login. That problem was updated broadcom drivers. Not exactly the same thing but maybe it'll spark something.