regedit :: Knowledge Base (KB)

regedit

Registry Editor

Open regedit.exe (as Administrator)
Navigate to “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System”
Right-click in the blank area in the right pane and select New > DWORD Value
Name the new value “LocalAccountTokenFilterPolicy”
Double-click on the newly created “LocalAccountTokenFilterPolicy” value
Type 1 into the “Value data” entry and click OK
Reboot the computer

If you want to change the value via CMD/PowerShell:

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1

In case remote access is mitigated thru User Rights Assignment you can use the following to disable this.

Attachments

C:\temp>ntrights.exe -r SeDenyNetworkLogonRight -u "Local Account"
Revoking SeDenyNetworkLogonRight from Local Account   ... successful

You need an elevated command prompt.

reg save hklm\system system
reg save hklm\sam sam
reg save hklm\security security