Deny Login Locally Broke our Admin group

Question

We made multiple mistakes applying a deny logon locally policy which we had though was set to deny the local admin for each computer, but it ended up denying any group/user that was in the Administrators group not local admin. So we removed that part of the policy but even after gpupdate /force and restarts of workstations it was still being blocked. We then created a new policy that specifically denied login for a new test account and applied that. Once that was applied our admin accounts could login. To further confuse myself I have a test computer deny all policies and could login, applied our default policy and the test deny policy and could still login, denied the default policy and could still login, denied the test policy and could not login. Checked rsop.msc and it shows default policy is still applied even though my test machine is in delegation and set to deny the policy. I am assuming the default policy in some way is still either denying the logins, or when the original deny was set, the deny was set locally and when a new policy doesn't have a deny policy it reverts back to the original deny setting that the first policy set. We have a plan to restore the sysvol folder to recover the policy files before all this happened but wanted to post to see if anyone had any ideas. Is the allow logon locally set will it deny login for anything not listed in allow? Thanks and sorry if that is too much text to follow.

Answer 1

Hi

Is the allow logon locally set will it deny login for anything not listed in allow?

Yes I confirm . When you set allow logon locally GPO settings , only users and groups mentioned in the list in this setting can logon.

Please don’t forget to accept helpful answer