I want to loop over all my domain service accounts and make sure that people can't log on the server using that account.

How can I check if a service account has interactive logon privileges and/or remote logon rights?

They aren't Managed Service Accounts because they are used as service accounts on multiple servers.

I tried gpresult /s myservername /user myusername /h gpreport.html but I don't really understand the report.

There was one section with:

Security Group Membership when Group Policy was applied

MYDOMAIN\Domain Users

Are these last 2 what allows this user to log in to the server?

Or is there a Group Policy I can check and look for using the command line?


This isn't a function of the user account, it's a function of the computer configuration AND the user account(s).

The easiest way to deny service accounts interactive logon privileges is with a GPO.

Open up group policy manager, and go to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment.

Add your service accounts (or if you planned ahead, a security group, containing your service accounts) to the Deny log on locally and Deny log on through Terminal Services (or Deny Log on through Remote Desktop Services, depending on your Windows version) settings.

Apply this GPO to the computers you want it to apply to, and you're done. (GPOs are still a rather large pain to deal with over a CLI, so I wouldn't advise that approach, but if you're deadset on doing it that way, that's what you'd look for, and where.)

| improve this answer | |
  • This is a good answer. I'd like to try to get this via powershell to speed things up when checking multiple servers. However, I haven't managed yet. – opticyclic Apr 24 '16 at 18:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.