Allow log on locally
Verified with Windows Security Options 25H2 — updated on July 25, 2026
Security policy
This is a Security Options policy (Windows Settings > Security Settings), applied by the security engine — not an Administrative Template (ADMX). In GPMC/gpedit it is configured under Local Policies > Security Options.
Path in the GPO console
Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment Description
Determines which users can log on to the computer. Important Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally (https://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website. Default: • On workstations and servers: Administrators, Backup Operators, Power Users, Users, and Guest. • On domain controllers: Account Operators, Administrators, Backup Operators, and Print Operators.
Local security policy
SeInteractiveLogonRight This setting has no registry key. It is stored in the local security database (LSA) and is configured through the Group Policy console or secpol.msc.