can't login as domain user on XP without Domain Users in Local Adm

Can somebody give me an idea of where I should look to fix this? The problem
is currently Domain Users are added to the Administrators group on the local
XP Pro SP 2 workstation and we would like to remove them and have them from
from the Local Users group. However, when I do this if we try to logon a
domain users to the domain on the workstation, it says that the user is not
allowed to log on interactively and refuses logon.

I've checked the domain controller policy and domain policy to make sure
they are not added to the disallow local logon entry.

This is a Windows Standard 2003 SP1 server.

Roger
Thu Jun 23 13:06:16 CDT 2005

The machine's local policy does not recognize the account as having
granted to it the User Right to Log on locally.
This is needed. Also, an account will not successfully log into an
XP machine at the console for an interactive sessions if it is not a
member of that machine's Users group (one way or another).
You could 1) make sure that the proper accounts are granted
the Log on locally User Right at each respective machine, and 2)
add the proper accounts to the machine's Users group or add
INTERACTIVE to it

--
Roger Abell
Microsoft MVP (Windows Security)

"Jesse C" <JesseC@discussions.microsoft.com> wrote in message
news:5CF20647-6CC6-4B5A-8070-1D6769C450C2@microsoft.com...
> Can somebody give me an idea of where I should look to fix this? The
problem
> is currently Domain Users are added to the Administrators group on the
local
> XP Pro SP 2 workstation and we would like to remove them and have them
from
> from the Local Users group. However, when I do this if we try to logon a
> domain users to the domain on the workstation, it says that the user is
not
> allowed to log on interactively and refuses logon.
>
> I've checked the domain controller policy and domain policy to make sure
> they are not added to the disallow local logon entry.
>
> This is a Windows Standard 2003 SP1 server.