User not allowed to log in to a computer?

[captaincrunch00]

I have checked off the box within the "Accounts" tab on the "Log on to" button that says "All computers" to allow this user to log into any computer we have.

They try to log into an XP machine and it says "Your account has been configured to not let you log onto this machine."

Anyone have this problem before?
Thanks
-Andrew

 

[peterjm]

Under the account tab, make sure the account isnt disabled and that the password isnt expired.

Also, in the "Member Of" tab, is the user a member of either Domain Users or Domain Admins?

In active Directory under your server name / computers do you see the computer your trying to login with? If not you might need to rejoin it to the domain. On the computer your trying to login on to the domain with, right click my computer, computer name, and make sure it is connected to a domain and not a workgroup.

Other than that, have you set any policies that might be blocking it?

 

[captaincrunch00]

Not locked, not expired.
Member of Domain Users

I see the computer that I'm trying to log in with.
Computer is joined to the domain.

I am pawing through my policies right now and don't see anything as of yet. Any ideas on what I'd be looking for?

The normal user can log onto that computer no problem, but this guy can't for some reason.

One sure fix would be to add him as an Admin on the local box when he logs into the domain, but this happens to frequently for that to be a good fix. It's a quick fix, not a good one.

 

[moorethan]

Take him out of all the groups except domain users then add him to one group at a time.

 

[tfg13]

Does he have this problem on all computers, or just this one? If just one computer, have you looked at the local groups? Does the local policy allow certain people to logon locally? Was the user included in a "bad" domain group?

 

[captaincrunch00]

He's only in the Domain User group.

He has this problem on all of the XP computers. I can't find any local policy stopping anyone from logging onto that computer.
Maybe I'm just not looking in the right place. Want to point me at the correct policies in case I'm really that blind? I've gone and checked all the local security policies, but didn't see any enabled that said "Don't allow certain users to log in to this computer" or anything as blatantly obvious as that.

Thanks for the continued help!
-Andrew

 

[tfg13]

Well, if other people are able to log on to that computer that are in the same domain user group, I don't think it's the computer that is stopping him. Do you have this person in a different OU than everyone else? Have you added this person to the domain admin group temporarily to test that login? Have you set up any sort of time restriction or computer restriction on his account?

 

[moorethan]

just create him a new account