Logon rights

The following table lists and describes logon rights These default settings are for Windows XP Professional.

Logon RightDescription

Access this computer from a network

Allows a user to connect to the computer over the network.

Default setting: Administrators, Everyone, Users, Power Users, and Backup Operators.

Allow logon through terminal services

Allows a user to log on to this computer through a Remote Desktop connection.

Default setting: Administrators and Remote Desktop Users

Log on as a batch job

Allows a user to log on using a batch-queue facility.

Default setting: No one.
If Internet Information Services (IIS) are installed, the right is automatically assigned to a built-in account for anonymous access to IIS.

Log on as a service

Allows a security principal to log on as a service. Services can be configured to run under the LocalSystem, LocalService, or NetworkService accounts, which have a built?in right to log on as a service. Any service that runs under a separate user account must be assigned the right

Default setting: No one

Log on locally

Allows a user to log on at the computer's keyboard.

Default setting: Administrators, Power Users, Users, Guest, and Backup Operators.

Log on as a service

Allows a security principal to log on as a service. Services can be configured to run under the LocalSystem, LocalService, or NetworkService accounts, which have a built-in right to log on as a service. Any service that runs under a separate user account must be assigned the right.

Default setting: No one

Deny access to this computer from network

Prohibits a user or group from connecting to the computer from the network.

Default setting: No one

Deny local logon

Prohibits a user or group from logging on directly at the keyboard.

Default setting: No one

Deny logon as a batch job

Prohibits a user or group from logging on through a batch-queue facility.

Default setting: No one

Deny logon as a service

Prohibits a user or group from logging on as a service.

Default setting: No one

Deny logon through terminal services

Prohibits a user or group from logging on as a Terminal Services client.

Default setting: No one

The special user account LocalSystem has almost all privileges and logon rights assigned to it, because all processes that are running as part of the operating system are associated with this account and these processes require a complete set of user rights.

Privileges

User Rights Assignment



© 2015 Microsoft Corporation. All rights reserved. Contact Us |Terms of Use |Trademarks |Privacy & Cookies