Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My active directory (SBS 2003) domain users cannot log on locally to a given client machine (XP SP3). Logon with the domain admin works.

I would like users to be able to logon locally to this computer, so I'm trying to find out where the restriction is set. For this I locally start rsop.msc and navigate to

Console Root / <ComputerName> / Computer Configuration / Windows Settings / Security Settings / Local Policies / User Rights Assignment

Here I would like to view the "Allow logon locally" policy, but it is missing.
I have many (all?) other policies, including "Deny logon locally" and "Allow logon through Terminal Services".

Why is "Allow logon locally" missing and how can I restore it?

share|improve this question

migrated from Aug 7 '12 at 12:52

This question came from our site for computer enthusiasts and power users.

which error do you get on the client? (take a look at the eventviewer also) – Cadburry Aug 7 '12 at 9:51

The keyboard layout was not set correctly (duh!). So the users could not log in.

I still don't know why the "Allow logon locally" policy is not available (while all other policies are available), but my problem is solved by changing the keyboard layout.

share|improve this answer

Based on the provided info, it sounds to me like the computer has become disjointed from the Domain.

If RSOP isn't showing you the GP results, then it's probably not get GP apply to it. :)

The "domain" admin. credentials probably appear to work because you have the same password set for the local Administrator account.

Disjoin it from the domain, ensure the computer's account is removed from AD, and rejoin.

share|improve this answer

I found the answer to this issue. In Windows XP, this setting is named somewhat differently from Windows 7, however it is still in the list. Instead of looking for "Allow logon locally" look for "Log on locally". This should give you the functionality you're looking for.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.