MS Security compliance baseline Windows 11 23 H2 Login Problems

Question

Hi,

I am implementing MS security baseline as highlighted in the following screenshot.

After implementing the baseline, I am NOT able to login to the user account. This account is a local account and I was signed in using this local account.

Any thoughts, should I (pre) add this user account into the Remote Desktop User Group? But that makes me confused as the administrator account has full access.

Answer 1

@~OSD~, Thanks for posting in Q&A. Based on my checking, there's a setting named "Deny Remote Desktop Services Log On" which determines which users and groups are prohibited from logging on as a Remote Desktop Services client. By default, Local account group (S-1-5-113) is added into the policy. That is to say, local account will be prevented from remoting to the device.

Please check if you have this setting configured in your security baseline and remove this setting to see if it works.

https://learn.microsoft.com/en-us/mem/intune/protect/security-baseline-settings-mdm-all?pivots=mdm-23h2

Hope the above information can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.