Grant local login but deny RDP access via GPO

Question

I'm trying to configure a service user in AD. The application that is going to be executed with this account requires the service user to be able to create sessions locally. And due to security considerations I want to deny RDP access for this user.

There are 2 GPO policies in place "Logon Locally" that grants "Allow log on locally" (SeInteractiveLogonRight) to members of the "Logon Locally" group and a second policy "Deny RDP Access" that has "Deny log on through Remote Desktop Services" (SeDenyRemoteInteractiveLogonRight) for members of "Deny RDP Access" set.

The "Logon Locally" GPO has a link precedence of 1 and the "Deny RDP Access" GPO has link precedence of 2 on the service user's OU in AD. Both GPOs have the "Enforced" flag.

The problem is that, if the service user is member of both groups "Logon Locally" and "Deny RDP Access" both local login (e.g. via PsExec -u <service_user> or runas /user:<service_user>) and, RDP access are not allowed:

C:\>runas /user:DOMAIN\service_user "echo \"test\""
Enter the password for DOMAIN\service_user:
Attempting to start echo "test" as user "DOMAIN\service_user" ...
RUNAS ERROR: Unable to run - echo "test"
1385: Logon failure: the user has not been granted the requested logon type at this computer.

I already tried to create another policy that has both SeInteractiveLogonRight and SeDenyRemoteInteractiveLogonRight, assigned this GPO to the service user's account but without success.

Is there a way to configure the policies in a way to be able to use the user in runas or PsExec commands but only locally?

Answer 1

The additional GPO that can help you with this issue would be the logon as a batch job. You can explicitly deny the user object RDP right, while still being able to create local sessions.

A small excerpt from the explain tab: For example, when a user submits a job by means of the task scheduler, the task scheduler logs that user on as a batch user rather than as an interactive user.

You create a specific group that holds service accounts and push them via a GPO, or just add the user objects on a need to add basis.

EDIT: You might want to check out the Log on as a service policy as well if you want to focus on minimizing access rights where needed.