How to Prevent/Allow Log on Locally via GPO?

6.3K

Local security settings in Windows let you allow or deny local (interactive) logon for users on computers. In this article, we’ll take a look at how to manage local logon permissions on Windows 10/11 and Windows Server 2019/2022.

Default log on policies

By default, Windows allows users to log on locally who are members of the following local groups (SAM):

• Administrators;
• Backup Operators;
• Users.

This applies to workstations/member servers. The exact list may vary depending on the Windows version or applied security baselines (but the core groups remain consistent).

Note. The Remote Desktop Users group does not affect local interactive logon. This group controls RDP access and is managed separately via the Allow logon through Remote Desktop Services policy.

If the server is promoted to an Active Directory domain controller, then the list of groups with local logon permissions is changed. Note that standard members of the “Users” group are excluded. Only the following groups are permitted to log on to the DC console:

• Account Operators;
• Administrators;
• Backup Operators;
• Print Operators;
• Server Operators.

Listing groups with local logon permissions using the local Group Policy

You can view the current list of groups with local logon permissions through the local Group Policy:

1. Run the Local Group Policy Editor (gpedit.msc);
2. Go to the following section Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment;
3. Find the Allow log on locally policy and open its settings;
   

   

With this policy, you can add or remove user groups (or individual user accounts) that are allowed to log on locally. For example, if you remove the local Users group from this policy, then your users will not be allowed to log in interactively to this device.

After changing the policy settings, it is not necessary to reboot the computer. Changes to user rights assignment of accounts will be applied the next time the user signs in to Windows.

Local versus Domain GPO

If you are working in a domain environment, a domain-level GPO will override local settings. Any changes you make in gpedit.msc will be overwritten at the next Group Policy refresh. You can force an immediate refresh by running gpupdate /force.

Manage Local Logon Rights from the Command Line

In modern environments, you won’t be able to manage logon rights via GUI tools like gpedit.msc in a scalable way. Instead, admins often use command-line tools like secedit to audit and export these settings.

For example, you can export current local security policies (including logon rights) using:

secedit /export /cfg C:\temp\secpol.cfg

This allows you to review or version-control the configuration.

Deny log on locally policy

In the same section of the GPO, there is another Deny log on locally policy, which allows you to forcibly deny interactive logons to users. It is empty by default. You can manually add users or groups to this policy that are not allowed to log on to this computer interactively. Note that the Deny log on locally policy has a higher priority than the Allow log on locally policy.

If the user does not have the permissions to log on locally, then when he logs on to the computer after entering the password, the following message will appear:

The sign in method you’re trying to use isn’t allowed. For more info, contact your network administrator.

Always try to configure login policies so that only legitimate users can log on the device console. For security reasons, prevent service accounts from logging on locally to computers in your organization.

Note. Restricting local interactive logon does not affect Remote Desktop access. In case you also need to restrict RDP logon, you need to configure the Allow logon through Remote Desktop Services and Deny logon through Remote Desktop Services policies.