Deny log on through Remote Desktop Services
This user right identifies the users and groups that are prohibited from performing a remote logon with the RemoteInteractive logon type.
since 0.9.8.11
Purpose
Security policy: [Privilege Rights] SeDenyRemoteInteractiveLogonRight =
This user right identifies the users and groups that are prohibited from performing a remote logon with the RemoteInteractive logon type. A denial takes precedence even when an account has the “Allow log on through Remote Desktop Services” right directly or through group membership.
The empty account list used here assigns SeDenyRemoteInteractiveLogonRight to no account or group. Consequently, this user right does not exclude any account from signing in through Remote Desktop Services. An empty assignment does not grant a logon right to any account.
A successful Remote Desktop sign-in still requires Remote Desktop connections to be permitted and the account to satisfy the applicable positive logon rights and other access conditions. In particular, the empty assignment neither enables Remote Desktop Services nor adds an account to the Administrators or Remote Desktop Users group.
Notes
Additional effects
Microsoft also associates this deny right with restrictions on connections through Remote Assistance. An empty assignment therefore removes an account restriction that this right would otherwise impose on that connection type. It does not enable Remote Assistance, which is controlled by separate settings.
Security
Clearing the assignment removes an explicit layer of protection against remote sign-ins. Accounts that were previously blocked solely by SeDenyRemoteInteractiveLogonRight can become eligible for remote sign-in if Remote Desktop is available and they have the required allow right and meet all other conditions.
This change does not give those accounts administrative privileges, general file access, or other system permissions. Their capabilities within a session continue to depend on the account, its group memberships, and the applicable access-control lists.
Notes
This is a computer-scoped user-right assignment in the local security policy. It is not an ADMX-based policy and does not control whether Remote Desktop itself is enabled.
A user-right assignment delivered through domain, site, or organizational-unit policy can override the local setting during policy processing. On a domain-joined computer, the effective account list can therefore differ from the locally configured empty list.
Changing this user right does not require a restart. The change takes effect for an affected account at its next logon.
Microsoft documentation
Microsoft Learn: Deny log on through Remote Desktop Services
Microsoft Learn: Account Rights Constants