the system does not permit you to log on interactively

[selina]

i'm trying to log using a user's account and i'm getting the error message "The system does not permit you to log on interactively" and doesn't let me log on.
this account is in the AD and other users are fine. I know there is Terminal Service Profile in AD console but it's set to Allow Log on to Terminal Server.
How can I fix this?

The servers are on win 2000 sp4.

 

[office politics]

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/gp/615.asp

MSDN Home > MSDN Library > Win32 and COM Development > Windows 2000 > Security Settings >
Log on locally
Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description
Determine which users can log on at the computer.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

The default groups that have this right on each platform are:

Workstations and Servers
Administrators
Backup Operators
Power Users
Users
Guest
Domain Controllers
Account Operators
Administrators
Backup Operators
Print Operators
Note

To allow a user to log on locally to a domain controller, you have to grant this right by means of the Default Domain Controller GPO.

Related Policies



Deny logon locally

 

[selina]

it was "deny logon locally" in group policy..
thx!