Allow log on locally - security policy setting

Intro

To allow local user logins on a Windows Server, you need to configure the "Allow log on locally" security policy setting. This can be done through the Local Security Policy or by using Group Policy in a domain environment. By default, local users are not allowed to log on unless they are explicitly granted this right.

Location

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Using Local Security Policy

1. Open Local Security Policy: Press Win+R, type secpol.msc, and press Enter.

2. Navigate to User Rights Assignment: Expand "Local Policies," then "User Rights Assignment".

3. Locate and Edit "Allow log on locally": Double-click the policy setting named "Allow log on locally".

4. Add Users or Groups: Click "Add User or Group," then "Add".

5. Specify Users/Groups: Enter the names of the users or groups you want to allow to log on locally, and click "OK".

6. Apply Changes: Close the Local Security Policy editor.

Windows Server 2022

• Create a new user

• Add the user to the Server Operator group.

• That's it.

Possible values

• User-defined list of accounts

• Not Defined

By default, the members of the following groups have this right on workstations and servers:

• Administrators

• Backup Operators

• Users

By default, the members of the following groups have this right on domain controllers:

• Account Operators

• Administrators

• Backup Operators

• Enterprise Domain Controllers

• Print Operators

• Server Operators

---

REFERENCES

• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/allow-log-on-locally

• https://learn.microsoft.com/en-us/answers/questions/2188466/windows-local-login?forum=windowserver-all&referrer=answers

• https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups