Deny access to this computer from the network
This user right identifies the accounts and groups that are explicitly denied a network logon to the computer.
since 0.9.8.11
Purpose
Security policy: [Privilege Rights] SeDenyNetworkLogonRight =
This user right identifies the accounts and groups that are explicitly denied a network logon to the computer. Network logons are used by services such as SMB file and printer sharing.
An empty assignment removes every account and group from the deny list. Consequently, no account is blocked from network logon by SeDenyNetworkLogonRight alone. In particular, this removes a possible barrier for local accounts that need to access shares hosted by another computer.
An empty list does not grant network access. The account must still have the corresponding network logon right, authenticate successfully, and possess the required share and file-system permissions. Network and firewall restrictions also remain in effect.
Notes
Security
An assigned deny right overrides the corresponding “Access this computer from the network” user right. Emptying the assignment removes that explicit override for all accounts, including local accounts and local administrator accounts.
This removes one layer of protection against unwanted network access. Accounts that can subsequently log on over the network may be able to enumerate shared resources and certain account or group information. They can access or modify shared data only where their permissions allow it.
For local administrator accounts, the absence of this denial also increases exposure to lateral movement. If an attacker obtains reusable credentials or password hashes, those credentials might be used for network logons to other computers. Emptying this user right does not, by itself, provide administrative privileges, unrestricted file access, or access to administrative shares.
Notes
This setting applies to the Network logon type. Local interactive logon and logon through Remote Desktop Services are governed by separate user rights.
A user-rights assignment change takes effect for an account at its next logon; Microsoft states that a computer restart is not required. Existing network connections may retain their current logon state until disconnected.
Microsoft documentation
Microsoft Learn: Deny access to this computer from the network
Microsoft Learn: Policy CSP – UserRights
Microsoft Learn: Local accounts