I'm trying to apply a New GPO that deny Local Logon in my client pc's but its not working even if i applied steps : Computer Configuration > Policies > Security Settings > Local Policies > User Rights Assignment > Deny log on locally

enter image description here

  • have you used gpresult or rsop to verify that the policy is being applied to the computer after running gpudate /force? – SteamerJ Dec 18 '18 at 15:27
  • yes i've already verified on the client computer that the policy is applied already ! – Youssef Mdaghri Alaoui Dec 18 '18 at 15:28
  • What exactly isn't working? How is it not working? How are you logging on to these clients? – joeqwerty Dec 18 '18 at 16:22
  • the local access to computer still working even if i apply this GPO! i can logon to the Desktop_LAB1 using a local accounts already created on it !! i don't know what's wrong with this GPO!! – Youssef Mdaghri Alaoui Dec 19 '18 at 9:07
  • 1
    Based on the screenshot, you haven't added any of those local accounts to the list, only a computer account (which can't be logged into anyway) and the SPDI domain account. Only accounts that appear in the list will be prevented from logging in. So at the moment SPDI is the only account that will be prevented from logging in. – Harry Johnston Dec 19 '18 at 10:11

Based on your screenshot, it seems that you added computers or computers group in this policy.

You must add users or groups containing users and not computers, because the purpose of this policy is to prevent users to log on.

  • yes but i'm wondering if i should apply it to Computer Configuration or USer Configuration ? – Youssef Mdaghri Alaoui Dec 19 '18 at 9:04
  • It's a Computer Configuration setting. You configure the computer to prevent specific users to log on. – Swisstone Dec 19 '18 at 17:01
  • Take a look at the 'explain' tab as to how this setting works. The idea is to apply this 'computer' policy to a computer with the accounts you want denied from logon listed here. So you can make a "Deny Joe" GPO with "CONTOSO\Joe" listed in this policy and link the "Deny Joe" GPO to the OU where the "Computer01" system is located. Then, "CONTOSO\Joe" won't be able to locally log on to any machine in that OU. – duct_tape_coder Dec 19 '18 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.