I have a case where a developer computer is in a environment where the IT department have set up a forced group policy for the user rights assignment policy "Log on as a service". The policy is set to be forced and not editable and therefore replaces the local settings totally.
As this is a development computer with SQL Server Developer Edition installed and a running IIS, this user right is used by both the default SQL Server accounts as well as the virtual accounts for the applications pools (which av dynamically added/removed to/from this user right when an application pool is added or removed). Without the SQL Server service account added to this user right, the SQL Server will not even start.
Personally I find it strange to have a forced GPO that prohibits default behaviour for a local user right. The IT department have added a bunch of admin service groups as well as a bunch of special user groups that seems to have been added as a workaround for other developer departments in the organization. Purely security wise I also question why other development departments should get the access "Log on as a service" on my computer when they really just want that access to their local computers.
Is it possible to deploy a GPO in way so it only adds the server settings to the local settings instead of replaces them?
Is is possible to deploy a GPO and still let it be editable by the local user?
Is possible to deploy the GPO in any other way so it doesn't affect the local settings?
Would it work with a workaround where a user group is added to the server GPO and where the local admin on the developer machine has access to administrate and add local service accounts to this group?
Would the method in no 4 work with the virtual accounts from the Application Pool or do they need to have direct access to the user right instead of implicitly through a user group?
What is best practices regarding GPO's for the user right "Log on as a service"? Spontaniously it seems strange to handle the user right the way it is done by this IT department.
Developer Machine: Windows 8.1 Enterprise Eng
AD Server: domainControllerFunctionality: 5 = ( WIN2012 ); domainFunctionality: 4 = ( WIN2008R2 ); forestFunctionality: 4 = ( WIN2008R2 );
Don't know if this indicates a Win2008R2 or Win2012-server.
Would really appreciate both detailed information about what's possible when it comes to GPO deployment as well as best practices and creative solutions of the specific problem!