Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My developers complained that they were no longer able to run IIS in their development environments and they very usefully tracked it down to the following issue:;EN-US;297519

Looking into it further it would appear that someone/something has altered the default domain group policy to add a single domain admin account to the Logon as a batch job right.

This obviously wiped out the default settings on all the workstations. We've yet to track down why it happened, but have at least identified how to remedy it.

Have tested on a single machine and indeed adding IWAM_MACHINENAME and IUSR_MACHINENAME to the Logon as a batch job right allows the devlopers to continue as previously.

I have no desire to go around and do this manually on all the machines in the company. Rather I am hoping that I can correct this in the same way it was perpatrated - via a group policy. My problem is, how do I add the accounts and replace the MACHINENAME part with the actual machine name when setting up the policy?

I've accepted Evan answer below because it does resolve the specific problem I asked about. However I was being a bit of an idiot. Removing the bad policy actually caused all the original assignments to return after a GPUPDATE. I'd forgotten that rather than being wiped, they were overridden. This was the case and made the job a whole lot easier - all fixed!

share|improve this question
up vote 3 down vote accepted

Ick. Those accounts don't have well-known SIDs.

I'd say that your best bet is to grab the "NTRights.exe" utility (see and write a script to run against the affected machines to add the necessary rights.

ntrights.exe -u IUSR_%COMPUTERNAME% +r SeDenyBatchLogonRight
share|improve this answer
Aha! That sounds like a plan Evan! Thanks for that. – Martin Oct 21 '09 at 21:10
That worked Evan, but turned out the answer was much simpler. Have accepted anyway because it is the correct way of doing what I thought I needed to do. – Martin Oct 21 '09 at 21:44
I'm assuming you removed the policy and the machines reverted back to their local security policy, eh? >smile< – Evan Anderson Oct 21 '09 at 23:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.