Domain Users Group?

OK...I managed to lockout everyone in the entire domain by doing the following:

I added the 'Domain Users' group to the 'Log on locally' setting in the domain policy. This immediately stopped everyone in the domain who tried to logon to there machine from being able to.

My question is why...I don't understand. Surely this should have meant that everyone in the domain (who is authenticated) can logon locally.

Naturally I set it back to undefined and the problem was sorted.

This is not the first time I have used this group without it having any effect what so ever. It effectively acts as an empty group for logon/policy things. The group show all of the users in the domain, when I check who the members are.

Any help would be much appreciated.

 

It should have worked as you wanted it to.

I wonder if you have some settings in your local logon policies that is causing problems. Or if your changes somehow spilled over into the Everyone group.

As far as treating Domain Users as an "empty group" - ???? and