> In our case, when a user calls "sudo ls", I think it is a three-step
> procedure:
> 1) sudo calls pam_authenticate to authenticate the user
> 2) sudo calls pam_acct_mgmt to make sure that the account is not
> locked, that the ldap/gpo policies permit the user to run sudo, etc
> 3) sudo refers to /etc/sudoers to determine if it can perform the sudo
> action (i.e. "ls").
>
> The GPO Logon Rights relate to step (2) of this procedure.
Forgive me if I'm misunderstanding, but wouldn't the pam_authenticate attempt an authentication against AD if AD was available, and at that phase determine whether it's locked out or not? In testing, a locked account cannot use sudoers, even if it has a session. If AD isn't available, it'd use the cached password (if enabled), but it wouldn't detect a lockout regardless. Step 2 seems moot outside of that permission check.
>You assert that Windows would allow a user to perform remote login
>(and
then access other services, batch jobs, privileged operations)
>using
only the RemoteInteractiveLogonRight. Is your assertion based
>on actual
testing on a Windows client? I ask because this is not
>my
understanding. I would expect that the RemoteInteractiveLogonRight
>would
be consulted when the user used RemoteDesktop on a
>Windows client to
login to the remote Windows server, and that the
>InteractiveLogonRight
(Allow/Deny Local Logon) would be consulted
>when the user attempted to
perform a privileged operation (using
>RunAs or UAC). However, I haven't
actually tested this yet, so it would
>be useful to know if you have
already tested this.