Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
group policy in Windows Server 2008

One of our employees changed the users setting in a group policy which effects the login permissions for Administrators users.

Each time I try to login locally, the following message shown:

You cannot log on because the logon method you are using is not allowed on this computer

All solutions found on the Internet worked inside Windows, but I have only access to the Command Prompt (by using repair wizard)

Any suggestions?

share|improve this question

migrated from stackoverflow.com Feb 13 '12 at 7:31

This question came from our site for professional and enthusiast programmers.

marked as duplicate by Iain Feb 13 '12 at 9:28

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

I would suggest validating the GPO being applied to the server. You should be able to do these changes by not logging into the computer and just editing the GPO. It will take by default ~90 minutes (GPO refresh time) for the change to be proprogated down. But if you do not see Administrators in the Allow logon locally or in the Deny logon, that's your culprit. Follow the steps below.

http://www.chicagotech.net/troubleshooting/cannotlogon.htm

  1. Run gpedit.msc.
  2. Expand Computer Configuration\Windows Settings\Security Settings\Local Policies
  3. Click on User Rights Assignment
  4. Ensure that "Allow log on locally" includes Administrators, Backup Operators, Domain Users or Users.

Case 2: Group Policy' "Deny log on locally" was setup to deny users or domain users. To setup allow users or domain users to logon the computer or domain locally, "Deny log on locally" should be empty or no users or domain users in the list. Please follow these steps to remove the users or domain users from the "Deny log on locally".

http://www.chicagotech.net/troubleshooting/cannotlogon.htm

  1. Run gpedit.msc.
  2. Expand Windows Settings\Security Settings\Local Policies
  3. Click on User Rights Assignment
  4. Ensure that "Deny log on locally" is empty.
share|improve this answer
    
thanks vejadu for the fast reply the problem is I can not login to any user :( so its impossible to write this command "Run gpedit.msc" –  Ahmad Al-Ghamdy Feb 12 '12 at 20:09

Well gpedit.msc is actually "Group Policy Management Console"

You can install it on any Windows 2008 server, or it's on a domain controller. For prior to 2008 servers, you need to download it.

But once you download it, you can update the GPO; if you have domain administrator permissions.

If not; you're going to have problems. ;-)

share|improve this answer