Network Logon Rights Configuration

Carlos Lopez 20 Reputation points
2026-11-12T09:41:57.6+00:00

Users are unable to access shared resources to remote computers due to conflicting Network Logon Rights assignments.

Windows for business | Windows 365 Enterprise
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Chen Tran 13,700 Reputation points Independent Advisor
    2026-11-12T11:01:51.75+00:00

    Hello Carlos,

    Thank you for posting question on Microsoft Windows Forum!

    The bottom line for this issue is that Windows applies a strict precedence rule. The "Deny access to this computer from the network" policy always overrides the "Access this computer from the network" policy when a user or group is subject to both. This indicates that even if a user is explicitly allowed to connect via the network, a conflicting deny entry (often inherited through group membership) will silently block access to shared folders.

    The suggestion here is to open local security policy on the Windows computer hosting the shared resource (the server or PC with the share), not on the client machine attempting to access it. Then navigate to Security Settings → Local Policies → User Rights Assignment. Open "Deny access to this computer from the network". Remove the affected user and any group through which the user might be denied (check nested group memberships as well). Then the next step is to open "Access this computer from the network" and ensure an appropriate authorized group (such as Users or Authenticated Users) is present. After that, in an elevated Command Prompt, run this command gpupdate /force to refresh policy and then retry accessing the share.

    If the issue persists, you can generate a report on the host computer to see exactly which Group Policy Objects (GPOs) are applying these rights. Run the command gpresult /h C:\Temp\gpresult.html in an elevated Command Prompt. Then open the generated HTML report and inspect the Computer Details section. Navigate to this path Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. Pay specific attention to Access this computer from the network. Check if essential groups (such as Authenticated Users, Domain Users, or specific administrative/service groups) have been stripped out and Deny access to this computer from the network. Check if any broad groups (such as Users, Guests, or custom security groups) were inadvertently added by a baseline GPO.

    It is also worth verifying that restricted network logon rights are not masking underlying NTLM restriction policies or SMB signing mismatches that trigger authentication drops prior to the logon right evaluation phase.

    You can consult the following articles for further reference.

    I hope you have found something useful here. If it helps you get more insight into the issue, it is appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-11-12T09:42:56.53+00:00

    Remove the affected users and their groups from Deny access to this computer from the network on the computer hosting the shared resource, because that assignment overrides Access this computer from the network when both apply.^1^

    Correct the effective assignment

    Perform these steps on the Windows computer hosting the share—not on the client attempting access:

    1. Run secpol.msc.
    2. Open Security Settings > Local Policies > User Rights Assignment.
    3. Open Deny access to this computer from the network.
    4. Remove the affected user and any group through which the user is denied.
      • Check nested memberships as well.
      • Do not remove intentional security entries such as Guests without assessing the impact.
    5. Open Access this computer from the network and ensure an appropriate authorized group is included. This right controls which users and groups can connect to the computer over the network.^1^
    6. Run the following from an elevated Command Prompt, then retry the share:
    gpupdate /force
gpresult /scope computer /r

    If Group Policy or Intune manages the device, changing Local Security Policy alone may be temporary. Correct the policy at its authoritative source instead.

    Identify which policy is winning

    Generate a Resultant Set of Policy report on the resource-hosting computer:

    mkdir C:\Temp 2>nul
gpresult /h C:\Temp\gpresult.html /f
start C:\Temp\gpresult.html

    Open the report and inspect Computer Details for the applied computer GPOs and user-right assignments. gpresult reports the resulting settings after overlapping policies have been processed.^2^

    For a domain-managed host:

    1. Open Group Policy Management.
    2. Edit the GPO identified by the report.
    3. Go to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
    4. Correct both:
      • Deny access to this computer from the network
      • Access this computer from the network
    5. Confirm that another higher-precedence GPO does not redefine either setting.
    6. Run gpupdate /force on the host and generate a new gpresult report.

    User-right assignments are computer settings, so targeting a user-only policy will not correct the host configuration.

    For Intune-managed Windows 365 Enterprise Cloud PCs

    Windows 365 Enterprise supports both Intune MDM policies and GPOs, so inspect both management channels when the Cloud PC is hybrid joined.^3^

    The applicable UserRights CSP settings are device-scoped:

    • ./Device/Vendor/MSFT/Policy/Config/UserRights/DenyAccessFromNetwork
    • ./Device/Vendor/MSFT/Policy/Config/UserRights/AccessFromNetwork

    They apply to supported Windows Pro, Enterprise, Education, and IoT Enterprise editions beginning with Windows 10 version 1803. User-right values can be supplied as SIDs or account/group strings; SIDs are preferable where localization might affect names.^1^

    In the Intune admin center:

    1. Go to Devices > Monitor > Configuration policy assignment failure.
    2. Locate the policies assigned to the affected Cloud PCs.
    3. Review policies that configure the same network logon rights.
    4. Remove the duplicate setting from one policy, or exclude the affected device group from the conflicting assignment.
    5. Synchronize the Cloud PC and verify the effective assignment again.

    When the same setting targets a device from conflicting Intune policies, Intune reports a conflict and applies neither setting; overlapping assignments should be removed or separated through exclusions or assignment filters.^4^

    If access remains denied

    After resolving the logon-right conflict, check the share and NTFS permissions independently. A user needs effective access through both layers. For SMB failures, review:

    Event Viewer > Applications and Services Logs > Microsoft > Windows > SMBClient > Connectivity/Security

    Windows 11 24H2 also enforces additional SMB security behavior by default. If the failure began after an upgrade, use the SMBClient event and exact error to distinguish network-logon denial from signing, guest-access, NTLM, or file-permission issues.^5^

    Avoid broadly granting the network logon right to individual users or removing baseline deny entries merely to make access work. Assign access to a dedicated authorized group and remove only the unintended conflicting membership.

    References

    1. Policy CSP - UserRights
    2. gpresult
    3. Compare Windows 365 Business and Enterprise
    4. Avoiding policy conflicts
    5. Access Denied when you access an SMB file share in Windows
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.