Troubleshooting Logon Problems

The previous section listed ways in which accounts can become disabled. Beyond the typical reasons for an account being disabled, some system settings can also cause access problems. Specifically, you should look for the following:

• User gets a message that says that the user can't log on interactively

  The user right to log on locally isn't set for this user and the user isn't a member of a group that has this right.

  The user might be trying to log on to a server or domain controller. If so, keep in mind that the right to log on locally applies to all domain controllers in the domain. Otherwise , this right only applies to the single workstation.

  If the user should have access to the local system, configure the Logon Locally user right as described in the section of Chapter 9 entitled "Configuring User Rights Policies."

• User gets a message that the system could not log the user on

  If you've already checked the password and account name , you might want to check the account type. The user might be trying to access the domain with a local account. If this isn't the problem, the global catalog server might be unavailable, and, as a result, only users with administrator privileges can log on to the domain.

• User has a mandatory profile and the computer storing the profile is unavailable

  When a user has a mandatory profile, the computer storing the profile must be accessible during the logon process. If the computer is shut down or otherwise unavailable, users with mandatory profiles won't be able to log on.

• User gets a message saying the account has been configured to prevent the user from logging on to the workstation

  The user is trying to access a workstation that isn't defined as a permitted logon workstation. If the user should have access to this workstation, change the logon workstation information as described in the section of this chapter entitled "Setting Permitted Logon Workstations."