User Access to a DC

Harrison Midkiff · External Since: Dec 09, 2003 Posts: 77

Hello:

I have something which has me puzzled. I have a user account which can
access one of my DC's. The user account is not a member of the Domain
Admins group and I have looked through the Domain Controller Security Policy
and can't figure out how he can login to a DC?

Any suggestions...

Harrison

Giorgos · External Since: Feb 13, 2009 Posts: 3

Hello,

Have you checked whether this user has a local account to the DC?

--------

Networking and Telecommunications group
http://groups.google.com/group/networking_and_telecoms

Giorgos · External Since: Feb 13, 2009 Posts: 3

Hello,

Have you checked whether this user has a local account to the DC?

--------

Networking and Telecommunications group
http://groups.google.com/group/networking_and_telecoms

Meinolf Weber [MVP-DS] · External Since: Jan 16, 2009 Posts: 29

Hello Harrison,

Check the policies at the domain controllers OU for:
Computer configuration, windows settings, security settings, local policies,
user rights assignment, "logon locally"

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Hello:
>
> I have something which has me puzzled. I have a user account which
> can access one of my DC's. The user account is not a member of the
> Domain Admins group and I have looked through the Domain Controller
> Security Policy and can't figure out how he can login to a DC?
>
> Any suggestions...
>
> Harrison
>

Meinolf Weber [MVP-DS] · External Since: Jan 16, 2009 Posts: 29

Hello Giorgos,

Sorry, but on a DC local accounts are not existing.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Hello,
>
> Have you checked whether this user has a local account to the DC?
>
> --------
>
> Networking and Telecommunications group
> http://groups.google.com/group/networking_and_telecoms

Harrison Midkiff · External Since: Dec 09, 2003 Posts: 77

Thanks for replying....

I checked the DC GPO policy and nothing unusual. Still a mystery....

Harrison

"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
news:ff16fb661939b8cb5bc9110a15dc@msnews.microsoft.com...
> Hello Harrison,
>
> Check the policies at the domain controllers OU for:
> Computer configuration, windows settings, security settings, local
> policies, user rights assignment, "logon locally"
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Hello:
>>
>> I have something which has me puzzled. I have a user account which
>> can access one of my DC's. The user account is not a member of the
>> Domain Admins group and I have looked through the Domain Controller
>> Security Policy and can't figure out how he can login to a DC?
>>
>> Any suggestions...
>>
>> Harrison
>>
>
>

Giorgos · External Since: Feb 13, 2009 Posts: 3

Meinolf, that is correct.

"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
news:ff16fb661939e8cb5bc927a60c9c@msnews.microsoft.com...
> Hello Giorgos,
>
> Sorry, but on a DC local accounts are not existing.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Hello,
>>
>> Have you checked whether this user has a local account to the DC?
>>
>> --------
>>
>> Networking and Telecommunications group
>> http://groups.google.com/group/networking_and_telecoms
>
>

Dhruv raj · External Since: Feb 13, 2009 Posts: 2

this is possible if this the first dc in your domain and the user account
exhisted
in the DC even before this dc was promoted To DC
as during dcpromo of the first dc the SAM account database in merged into
the NTDS.dit
the second possibility is
you might have the user listed in "allow logon locally " in the local
security policy
of the dc OR the default domain controlelr security policy
----
Dhruv Raj
mcse 2003

"Harrison Midkiff" wrote:

> Hello:
>
> I have something which has me puzzled. I have a user account which can
> access one of my DC's. The user account is not a member of the Domain
> Admins group and I have looked through the Domain Controller Security Policy
> and can't figure out how he can login to a DC?
>
> Any suggestions...
>
> Harrison
>
>
>

Dhruv raj · External Since: Feb 13, 2009 Posts: 2

this is possible if this the first dc in your domain and the user account
exhisted
in the DC even before this dc was promoted To DC
as during dcpromo of the first dc the SAM account database in merged into
the NTDS.dit
the second possibility is
you might have the user listed in "allow logon locally " in the local
security policy
of the dc OR the default domain controlelr security policy
----
dhruv

"Harrison Midkiff" wrote:

> Hello:
>
> I have something which has me puzzled. I have a user account which can
> access one of my DC's. The user account is not a member of the Domain
> Admins group and I have looked through the Domain Controller Security Policy
> and can't figure out how he can login to a DC?
>
> Any suggestions...
>
> Harrison
>
>
>