Network Logon Rights Configuration

Remove the affected users and their groups from Deny access to this computer from the network on the computer hosting the shared resource, because that assignment overrides Access this computer from the network when both apply.^1^

Correct the effective assignment

Perform these steps on the Windows computer hosting the share—not on the client attempting access:

1. Run secpol.msc.
2. Open Security Settings > Local Policies > User Rights Assignment.
3. Open Deny access to this computer from the network.
4. Remove the affected user and any group through which the user is denied.
   • Check nested memberships as well.
   • Do not remove intentional security entries such as Guests without assessing the impact.
5. Open Access this computer from the network and ensure an appropriate authorized group is included. This right controls which users and groups can connect to the computer over the network.^1^
6. Run the following from an elevated Command Prompt, then retry the share:

gpupdate /force
gpresult /scope computer /r

If Group Policy or Intune manages the device, changing Local Security Policy alone may be temporary. Correct the policy at its authoritative source instead.

Identify which policy is winning

Generate a Resultant Set of Policy report on the resource-hosting computer:

mkdir C:\Temp 2>nul
gpresult /h C:\Temp\gpresult.html /f
start C:\Temp\gpresult.html

Open the report and inspect Computer Details for the applied computer GPOs and user-right assignments. gpresult reports the resulting settings after overlapping policies have been processed.^2^

For a domain-managed host:

1. Open Group Policy Management.
2. Edit the GPO identified by the report.
3. Go to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
4. Correct both:
   • Deny access to this computer from the network
   • Access this computer from the network
5. Confirm that another higher-precedence GPO does not redefine either setting.
6. Run gpupdate /force on the host and generate a new gpresult report.

User-right assignments are computer settings, so targeting a user-only policy will not correct the host configuration.

For Intune-managed Windows 365 Enterprise Cloud PCs

Windows 365 Enterprise supports both Intune MDM policies and GPOs, so inspect both management channels when the Cloud PC is hybrid joined.^3^

The applicable UserRights CSP settings are device-scoped:

• ./Device/Vendor/MSFT/Policy/Config/UserRights/DenyAccessFromNetwork
• ./Device/Vendor/MSFT/Policy/Config/UserRights/AccessFromNetwork

They apply to supported Windows Pro, Enterprise, Education, and IoT Enterprise editions beginning with Windows 10 version 1803. User-right values can be supplied as SIDs or account/group strings; SIDs are preferable where localization might affect names.^1^

In the Intune admin center:

1. Go to Devices > Monitor > Configuration policy assignment failure.
2. Locate the policies assigned to the affected Cloud PCs.
3. Review policies that configure the same network logon rights.
4. Remove the duplicate setting from one policy, or exclude the affected device group from the conflicting assignment.
5. Synchronize the Cloud PC and verify the effective assignment again.

When the same setting targets a device from conflicting Intune policies, Intune reports a conflict and applies neither setting; overlapping assignments should be removed or separated through exclusions or assignment filters.^4^

If access remains denied

After resolving the logon-right conflict, check the share and NTFS permissions independently. A user needs effective access through both layers. For SMB failures, review:

Event Viewer > Applications and Services Logs > Microsoft > Windows > SMBClient > Connectivity/Security

Windows 11 24H2 also enforces additional SMB security behavior by default. If the failure began after an upgrade, use the SMBClient event and exact error to distinguish network-logon denial from signing, guest-access, NTLM, or file-permission issues.^5^

Avoid broadly granting the network logon right to individual users or removing baseline deny entries merely to make access work. Assign access to a dedicated authorized group and remove only the unintended conflicting membership.

References

1. Policy CSP - UserRights
2. gpresult
3. Compare Windows 365 Business and Enterprise
4. Avoiding policy conflicts
5. Access Denied when you access an SMB file share in Windows