First, shut down all domain controllers. Doing so will avoid bizarre replication problems.
The first step is to remove the bad Group Policy setting. Privilege assignments are stored in the
GptTmpl.inf file in
MACHINE\Microsoft\Windows NT\SecEdit under each policy folder. You'll know you have the right policy when that
.inf file contains a line for
SeDenyInteractiveLogonRight, et cetera. Delete all the
SeDeny...Right lines from it.
Windows won't apply the new settings unless it sees that the GPO has changed, which it determines by consulting the
versionNumber attribute on an Active Directory object. Let's not try to edit AD offline. Instead, we'll remove the bad settings from the Registry manually.
Mount the domain controller's
\Windows\System32\config\SECURITY hive into another Windows system's Registry with
reg load. Open the Registry Editor and navigate to
Policy\Accounts under the mounted hive. (You may need to be running
regedit as SYSTEM for that to work. PsExec can do that.) Each subkey of that corresponds to a user or group, and the
ActSysAc subkey of each of those holds the "rights." (The "privileges" are all in the
Privilgs subkey.) Find the one with an
ActSysAc value of
C0 03 00 00, which corresponds to the four rights you denied. Delete
ActSysAc or change its value to
00 00 00 00. Close the Registry Editor and unmount the hive with
Boot up the domain controller you modified. You should be able to log in now. Use the Group Policy Management Console to make any edit (no matter how trivial) to the relevant GPO's Local Policies. That will increment the GPO's version number.
Boot up the other domain controllers and let the changes replicate.