Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am not much of a server administrator, but get my feet wet when I have to.

Right now I'm running some COTS software on a Windows 2008 Server machine. The software installer creates a few user accounts for running its processes, and then gives those users the right to "log on as a batch job".

Every so often (e.g. yesterday at 2:52pm and this morning at 7:50am), those rights disappear. The software then stops working. I can verify that the user rights are gone by using

secedit /export /cfg e:\temp\uraExp.inf /areas USER_RIGHTS

and I have a script that does this every 30 seconds and logs the results with a timestamp, so I know when the rights disappear.

What I see from the export is that in the "good" state, i.e. after I install the software and it's working correctly, the line for SeBatchLogonRight from the secedit export includes the user accounts created by the software. But every few hours (sometimes more), those user accounts are removed from that line. The same thing can be seen by using the GUI tool Local Security Policy > Security Settings > Local Policies > User Rights Assignment > Log on as a batch job: in the "good" state, that policy includes the needed user accounts, and in the bad state, the policy does not.

Based on the above-mentioned logging script and the timestamps at which the user rights are being removed, I can see clearly that some GPOs are causing the change. The GPO Operational log shows GPOs being processed at exactly the right times. E.g.:

Starting Registry Extension Processing. 

List of applicable GPOs: (Changes were detected.) 

Local Group Policy 

I have run GPOs on demand using gpupdate /force, and was able to verify that this caused the User Rights to be removed.

We have looked over local group policies till our eyes are crossed, trying to figure out which one might be stripping these User Rights to "log on as a batch job." We have not configured any local group policies on this machine, that we know of; so is there a default local group policy that might typically do such a thing? Are there typical domain policies that would do this?

I have been working with our IT staff colleagues to troubleshoot the problem, but none of them are really GPO experts... They wear many hats, and they do what they need to do in order to keep most things running.

Any suggestions would be greatly appreciated!

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

The "Resultant Set of Policy" tool will help you out here; it's at the bottom of the left sidebar in Group Policy Management Console.

Point it at the machine, then on the settings tab, you'll find each item set by policies applied to the system, and which GPO that setting came from.

share|improve this answer
1  
Create a new GPO that sets the desired value, and link it to an OU that's closer to the computer than the one you want to override. As long as the Default Domain Policy isn't set to "enforce" mode, then more specific link prevails. –  Shane Madden Apr 14 '11 at 21:13
1  
It doesn't need to be linked closer to the target it just needs to be at a higher precedence (lower link order) than the Default Domain Policy so that it's applied later than the Default Domain Policy. Both policies can be linked at the domain level. –  joeqwerty Apr 15 '11 at 0:12
1  
@joeqwerty Fair enough! I'm having a hard time balancing thorough explanation of GPO inheritance against a need for brevity (which is why I opted not to go into precedence of links on a single object, inheritance blocking, links to sites, or how loopback processing fits in). I appreciate the help in pointing out stuff that's relevant to the question like being able to link this on the domain. –  Shane Madden Apr 15 '11 at 1:23
1  
@Shane: Gotcha. Explaining Group Polcy and the processing thereof can get a bit convoluted. –  joeqwerty Apr 15 '11 at 1:39
2  
@LarsH: Just to chime in again (not that Shane needs my help), those settings are not typically configured in the Default Domain policy. They are set to "not configured" in a default install of AD, when the default Group Policy objects are created so it's unlikely that the developers have seen your particular problem before and it's not very likely that they'll see it again. –  joeqwerty Apr 16 '11 at 13:18
show 6 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.