What would happen if you remove a GPO containing the "allow log on locally" setting

Question

Suppose you have a GPO that sets the "allow log on locally" setting.

What would happen if you removed this GPO from a device?

Would the PC end up with nothing in the "allow log on locally" setting, or would it just revert back to default values?

Answer 1

Yes, nothing. The defaults are below if this is what you want then add them back in there.

--please don't forget to close up the thread here by marking answer if the reply is helpful--

Answer 2

Hello Rob Torquemada,

Thank you for posting in Q&A forum.

If the setting hasn't been previously defined for the device on this client.

If a previous value doesn't exist in the database, then the setting doesn't revert to anything and remains defined as is. This behavior is sometimes referred to as "tattooing".

Would the PC end up with nothing in the "allow log on locally" setting, or would it just revert back to default values?
A: It remains the value "allow log on locally" setting within GPO in the domain controller.

For more information, please refer to the part of "Persistence of security settings policy" in the link below.
https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/security-policy-settings#persistence-of-security-settings-policy

Hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 3

Something here could help.

https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/allow-log-on-locally

I'd always double check it to confirm.

--please don't forget to close up the thread here by marking answer if the reply is helpful--