I'm trying to configure a service user in AD. The application that is going to be executed with this account requires the service user to be able to create sessions locally. And due to security considerations I want to deny RDP access for this user.
There are 2 GPO policies in place "Logon Locally" that grants "Allow log on locally" (SeInteractiveLogonRight) to members of the "Logon Locally" group and a second policy "Deny RDP Access" that has "Deny log on through Remote Desktop Services" (SeDenyRemoteInteractiveLogonRight) for members of "Deny RDP Access" set.
The "Logon Locally" GPO has a link precedence of 1 and the "Deny RDP Access" GPO has link precedence of 2 on the service user's OU in AD. Both GPOs have the "Enforced" flag.
The problem is that, if the service user is member of both groups "Logon Locally" and "Deny RDP Access" both local login (e.g. via
PsExec -u <service_user> or
runas /user:<service_user>) and, RDP access are not allowed:
C:\>runas /user:DOMAIN\service_user "echo \"test\"" Enter the password for DOMAIN\service_user: Attempting to start echo "test" as user "DOMAIN\service_user" ... RUNAS ERROR: Unable to run - echo "test" 1385: Logon failure: the user has not been granted the requested logon type at this computer.
I already tried to create another policy that has both
SeDenyRemoteInteractiveLogonRight, assigned this GPO to the service user's account but without success.
Is there a way to configure the policies in a way to be able to use the user in runas or PsExec commands but only locally?